Malicious Code Vulnerability in spellcheckerpy Package
Summary
MAL-2026-375: Malicious code in spellcheckerpy (PyPI). Affects spellcheckerpy versions 1.0.0 – 1.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The spellcheckerpy package, available on PyPI, is designed to provide spell-checking functionalities for Python applications. It is intended for developers looking to integrate spell-checking capabilities into their projects. However, this package has been found to contain malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability originates from the package's hidden code, which executes upon import or usage of the library. This code downloads a second-stage script that connects to a remote host, allowing the attacker to execute commands on the victim's machine. The malicious behavior includes obfuscation techniques to hide its true intent, making it difficult for users to detect. The package is part of a broader campaign targeting spell-checking libraries, indicating a systematic approach to compromise user systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall spellcheckerpyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the spellcheckerpy package until the vulnerability is fully addressed. Alternatively, consider using other reputable spell-checking libraries that do not exhibit similar malicious behavior.
Conclusion
The spellcheckerpy package has been identified as containing malicious code that compromises user security. It is essential for users to take immediate action by updating or removing the package to protect their systems from potential threats.
See every vulnerability recorded for spellcheckerpy →
FAQ
The malicious code is designed to download and execute remote scripts, allowing unauthorized access to the victim's machine.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you have installed spellcheckerpy, it is crucial to uninstall the package immediately and update to a safe alternative or the patched version.
Yes, versions 1.0.0, 1.1.0, and 1.3.0 of spellcheckerpy are known to contain the malicious code.
Using the compromised package can lead to unauthorized access to your system, data theft, and potential further exploitation by attackers.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
