Malicious Code Vulnerability in tableapy: A Threat to PyPI Users
Summary
MAL-2026-650: Malicious code in tableapy (PyPI). Affects tableapy versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tableapy is a Python package available on the Python Package Index (PyPI) that is designed to facilitate table manipulation and data processing tasks. However, it has been identified to contain malicious code that executes hidden commands and downloads additional harmful scripts, posing a significant risk to users who import or utilize this library.
Vulnerability Detail
The vulnerability in tableapy originates from a malicious campaign identified as '2025-11-spellcheckers'. The package includes obfuscated code that executes upon import, which connects to remote servers to download and execute further malicious scripts. This can lead to unauthorized access, data theft, and potential control over the victim's machine, making it a severe security threat.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall tableapyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the tableapy package until a secure version is released. Consider using alternative libraries for table manipulation that are known to be safe and have a good security track record.
Conclusion
The discovery of malicious code in the tableapy package highlights the importance of vigilance when using third-party libraries. Users are advised to uninstall the affected version and seek alternatives while monitoring for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in open-source software.
See every vulnerability recorded for tableapy →
FAQ
The malicious code is designed to execute hidden commands and download additional harmful scripts from remote servers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed tableapy, you should uninstall it immediately and refrain from using it until a patched version is available.
Yes, there are several alternatives for table manipulation in Python, such as pandas and tablib, which are widely used and trusted.
Vulert monitors and alerts users in real-time for open-source vulnerabilities in their software by analyzing the Pipfile.lock, ensuring that developers are aware of potential risks.
