{"id":"MAL-2025-6794","summary":"Malicious code in num2words (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (23a528edd10eb63e7c7932830fdb314983cadc840ce8ccfbaa04ad821bbdc1da)\nThe `num2words` project was compromised via a phishing attack and two new versions were uploaded to PyPI containing malicious code. The affected versions have been removed from PyPI, and users are advised to remove the affected versions from their environments.\n\n## Source: google-open-source-security (36822c42f7e862f29cef9734efec9a9a9cc44a80e619e954dd25c12239d15767)\nThe num2words project was compromised via a phishing attack and two new\nversions were uploaded to PyPI containing malicious code.\n","aliases":["GHSA-jxr6-qrxx-2ph2","PYSEC-2025-72"],"modified":"2026-07-23T07:53:03.562857918Z","published":"2025-07-31T19:33:29Z","database_specific":{"malicious-packages-origins":[{"versions":["0.5.15","0.5.16"],"source":"google-open-source-security","sha256":"36822c42f7e862f29cef9734efec9a9a9cc44a80e619e954dd25c12239d15767","import_time":"2025-08-06T01:07:01.055679Z","modified_time":"2025-08-06T01:01:03Z"},{"versions":["0.5.16","0.5.15"],"source":"ghsa-malware","sha256":"23a528edd10eb63e7c7932830fdb314983cadc840ce8ccfbaa04ad821bbdc1da","import_time":"2026-07-22T03:44:29.053827259Z","id":"GHSA-jxr6-qrxx-2ph2","modified_time":"2026-07-21T17:23:21Z","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.15"},{"last_affected":"0.5.16"}]}]}]},"references":[{"type":"WEB","url":"https://nitter.tiekoetter.com/SFLinux/status/1949906299308953827"},{"type":"ARTICLE","url":"https://www.stepsecurity.io/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/num2words/PYSEC-2025-72.yaml"},{"type":"WEB","url":"https://www.stepsecurity.io/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jxr6-qrxx-2ph2"}],"affected":[{"package":{"name":"num2words","ecosystem":"PyPI","purl":"pkg:pypi/num2words"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.15"},{"last_affected":"0.5.16"}]}],"versions":["0.5.15","0.5.16"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/num2words/MAL-2025-6794.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5"}