Malicious Code Vulnerability in telepycore: Remote Executable Installation Risk
Summary
MAL-2025-191889: Malicious code in telepycore (PyPI). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
telepycore is a Python package available on PyPI, designed for various functionalities in Python applications. However, it has been identified as having a significant security vulnerability that allows for the installation of malicious code. This vulnerability can lead to unauthorized access and control over affected systems, posing a serious risk to users and their data.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as 2025-04-telepycore. The package can be exploited to install a remote executable that ensures persistence by starting on logon and mimicking a network service. Different versions of the package may contain various malicious executables, which are flagged by multiple antivirus solutions and sandboxes. The malicious behavior includes downloading and executing remote executables, which can lead to severe security breaches.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall telepycoreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the telepycore package until a patch is confirmed. Additionally, consider implementing network security measures such as firewalls and intrusion detection systems to monitor and block suspicious activities.
Conclusion
The telepycore package has been identified as having a serious vulnerability that can lead to the installation of malicious code. Users are strongly advised to update the package immediately and monitor their systems for any suspicious activity. Utilizing tools like Vulert can help in identifying and managing vulnerabilities effectively.
See every vulnerability recorded for telepycore →
FAQ
telepycore is a Python package used for various functionalities in Python applications, but it has been found to contain malicious code.
The vulnerability allows attackers to install remote executables on your system, potentially leading to unauthorized access and control.
Immediately update the package to the latest version using 'pip install --upgrade telepycore' or consider removing it until a patch is confirmed.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the Pipfile.lock. Check your application for vulnerabilities at Vulert Scanner.
Detailed information can be found in the vulnerability report on the Open Source Vulnerability database or by checking the package's repository.
