Which versions of tensorflows are malicious?

The following PyPI versions of tensorflows are flagged malicious: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4. Treat any of these as compromised.

How do I remediate tensorflows if I installed it?

tensorflows is a typosquat — you almost certainly intended a legitimately-named package. Remove tensorflows, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed tensorflows — how do I know if it already compromised me?

If tensorflows was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is tensorflows part of a known attack campaign?

Yes — tensorflows is associated with the 2025-05- yesyesyes campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tensorflows across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for tensorflows (11 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging tensorflows across your stack and pipelines.

Malicious package

tensorflowsPyPI

Malicious code in tensorflows (PyPI) Remove it immediately and rotate any exposed credentials.

MAL-2025-191891

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall tensorflows

What this malware does

Clearly typosquatting packages, but no known malicious parts.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2025-05- yesyesyes

Reasons (based on the campaign):

typosquatting

Malicious versions

11 flagged

1.0.01.0.11.0.21.0.31.0.41.0.51.1.01.1.11.1.21.1.31.1.4

Indicators of compromise (SHA-256)

d47039abe1931b7e4e75ab44d59a042ff1d113feefd8b34711404fb8dfa83cf8

e08c37ae45b3a5d5a85a5555ded262e154d91f563636cb5b149176e1aaf12fa7

99cd541745226a74ee33fe410814677b1282d826f892299259ef0a748b4b6bca

5aa311f37ff07eae1d38706eb555794793680059e3ec6e5e6e2f48677a04d4c0

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for tensorflows (11 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging tensorflows across your stack and pipelines.
If you installed it — respond
tensorflows is a typosquat — you almost certainly intended a legitimately-named package. Remove tensorflows, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If tensorflows was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks tensorflows before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. tensorflows on PyPI has been identified as a malicious package (versions 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.1.1, and 3 more flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2025-05- yesyesyes

References

bad-packages.kam193.eu

Credits

Kamil Mańkowski (kam193)

Detect & block this

O3 blocks tensorflows-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring