Malicious code in pytablute (PyPI)

The pytablute package on PyPI was identified as containing malicious code designed to execute hidden functionality when the library is imported or used. The malware downloads second-stage code from a remote host and establishes a background process that periodically connects to an attacker-controlled server awaiting command execution.\n\nThe malicious behavior includes obfuscation techniques, remote script download and execution, and the ability to execute remote commands on the victim's machine, likely restricted to a specific command set. This package was part of a coordinated malicious campaign labeled 2025-11-spellcheckers.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-13685), which tracks confirmed malicious packages across package ecosystems.