Malicious Code Vulnerability in acpi-tables Package
Summary
MAL-2026-876: Malicious code in acpi-tables (PyPI). Affects acpi-tables versions 1.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The acpi-tables package, available on PyPI, is designed to provide functionality related to ACPI (Advanced Configuration and Power Interface) tables. However, this package has been identified as malicious, containing code that exfiltrates basic information about the host system. Users typically install such packages for legitimate purposes, but this vulnerability poses a significant risk to their privacy and security.
Vulnerability Detail
The vulnerability originates from the package's design, which overrides the install command in setup.py to execute malicious code during installation. This code is capable of exfiltrating sensitive information such as the user's IP address and username. The package has no legitimate functionality beyond this malicious behavior, making it a clear threat to users who install it.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall acpi-tablesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no specific workarounds to mitigate the effects of this malicious package. The best course of action is to avoid installing it and to remove it if already installed.
Conclusion
The acpi-tables package poses a serious security risk due to its malicious code that exfiltrates user information. Users are advised to uninstall this package immediately and to remain vigilant about the packages they install. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for acpi-tables →
FAQ
The acpi-tables package is intended to provide functionality related to ACPI tables, but it has been identified as malicious and serves no legitimate purpose.
You can check your installed packages by running 'pip list' in your terminal. Look for 'acpi-tables' in the list.
You should uninstall the package immediately using the command 'pip uninstall acpi-tables'.
Currently, there is no safe or patched version of the acpi-tables package available. It is recommended to avoid using it entirely.
You can use tools like Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against known vulnerabilities using the Vulert playground without any signup.
