Which versions of tensorflows are malicious?

The following PyPI versions of tensorflows are flagged malicious: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4. Treat any of these as compromised.

How do I remediate tensorflows if I installed it?

tensorflows is a typosquat — you almost certainly intended a legitimately-named package. Remove tensorflows, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed tensorflows — how do I know if it already compromised me?

If tensorflows was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is tensorflows part of a known attack campaign?

Yes — tensorflows is associated with the 2025-05- yesyesyes campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tensorflows across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for tensorflows (11 malicious versions).

Malicious package

tensorflowsPyPI

Advisory published May 26, 2025Updated Dec 31, 2025

tensorflows is a confirmed malicious PyPI package (MAL-2025-191891) that typosquats a legitimate package to trick installs (malicious versions 1.0.0, 1.0.1, 1.0.2…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in tensorflows (PyPI)

MAL-2025-191891

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall tensorflows

What this malware does

Clearly typosquatting packages, but no known malicious parts.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2025-05- yesyesyes

Reasons (based on the campaign):

typosquatting

Malicious versions

11 flagged

1.0.01.0.11.0.21.0.31.0.41.0.51.1.01.1.11.1.21.1.31.1.4

Indicators of compromise (SHA-256)

d47039abe1931b7e4e75ab44d59a042ff1d113feefd8b34711404fb8dfa83cf8

e08c37ae45b3a5d5a85a5555ded262e154d91f563636cb5b149176e1aaf12fa7

99cd541745226a74ee33fe410814677b1282d826f892299259ef0a748b4b6bca

5aa311f37ff07eae1d38706eb555794793680059e3ec6e5e6e2f48677a04d4c0

Detection & response playbook

Typosquat

Find it
Search your lockfiles and build artifacts for tensorflows (11 malicious versions).
If you installed it — respond
tensorflows is a typosquat — you almost certainly intended a legitimately-named package. Remove tensorflows, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If tensorflows was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. tensorflows on PyPI has been identified as a malicious package (versions 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.1.1, and 3 more flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2025-05- yesyesyes

References

bad-packages.kam193.eu

Credits

Kamil Mańkowski (kam193)

Detect & block this

O3 blocks tensorflows-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database