MAL-2025-191889

    Dashboard / Malicious Package / MAL-2025-191889

    MAL-2025-191889

    Published: 30 Apr 2025Last Modified: 31 Dec 2025

    Summary: Malicious code in telepycore (PyPI)

    Details: Source: kam193 (c3dcd0a2a8162a703ef9d7b90566e4c55116a7f4f4d3b8759ca0d2640acd4ee4) Package can only be used (requires additional triggering) to install a remote executable, ensure it starts on logon and name mimic network service. Though different versions contain different executables, they are mostly identified as malicious by multiple AVs and sandboxes, highlighting adding Defender exclusions and downloading further executables. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-04-telepycore Reasons (based on the campaign): - peristence-autorun - Downloads and executes a remote executable.

    References: https://www.virustotal.com/gui/file/34d499a6ccf6634ab8eda9424111cf56c872ec426c1f9de03054569508f17367/detection, https://www.virustotal.com/gui/file/1493cafd2842330835f48cbebfcdd4bf24be8dd5125dcc3e9ee746d0063f23c8/detection, https://www.virustotal.com/gui/file/3f516fdb7c101f60b01bd482c51ac458c06c5df08d0b9e6d87e4d89e74449630, https://tria.ge/250430-1emz2shk4x/behavioral1, https://tria.ge/250430-1h1qbaylt9/, https://tria.ge/250430-1njc8ahl9y/behavioral1, https://bad-packages.kam193.eu/pypi/package/telepycore

    Affected packages

    Package

    Name: telepycore

    Purl: pkg:pypi/telepycore

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.4
    2.0.2
    2.0.5
    2.0.7
    2.0.6
    2.0.1
    MAL-2025-191889 | CVE-DB