Malicious Code Vulnerability in telco Package: Reverse Shell Threat
Summary
MAL-2025-192363: Malicious code in telco (PyPI). Affects telco versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The telco package, available on PyPI, is designed for telecommunications-related functionalities. It is utilized by developers to integrate telecommunication features into their applications. However, a recent vulnerability has been identified that allows malicious actors to exploit the package, leading to severe security risks for users.
Vulnerability Detail
The vulnerability originates from a malicious code embedded in the telco package, specifically in version 1.0.1. This code initiates a reverse shell when the module is executed, enabling attackers to run arbitrary commands on the victim's machine. The malicious intent is evident as it falls under a campaign categorized as '2025-12-evil-rce', which is aimed at compromising user systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall telcoIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the telco package until a patch is released. Additionally, running security scans on the application can help identify any instances of the malicious code.
Conclusion
The telco package has been compromised with malicious code that creates a reverse shell, posing significant risks to users. It is crucial to update the package to a patched version and monitor your systems for any signs of exploitation. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for telco →
FAQ
The telco package is a Python library used for integrating telecommunications functionalities into applications.
The vulnerability allows attackers to execute arbitrary commands on your machine, potentially leading to data theft or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update the package, refrain from using it and consider implementing security measures to monitor your system for any suspicious activity.
For more information on open-source vulnerabilities, you can visit Vulert, which monitors and alerts for vulnerabilities in real-time using Pipfile.lock.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
