Malicious Code Vulnerability in spellcheckpy Package
Summary
MAL-2026-441: Malicious code in spellcheckpy (PyPI). Affects spellcheckpy versions 1.1.0 – 1.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
spellcheckpy is a Python package available on PyPI that provides functionalities for spell checking in various applications. It is designed to be easy to use and integrate into Python projects. However, the package has been found to contain malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability originates from a malicious campaign identified as '2025-11-spellcheckers'. The package contains hidden code that executes upon import, which downloads additional malicious scripts. This code allows for remote command execution on the victim's machine and establishes a connection to a remote host to receive further instructions. The obfuscation techniques used in the code make it difficult to detect, and the potential ramifications include unauthorized access to sensitive information and control over the victim's system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall spellcheckpyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the spellcheckpy package until a secure version is released. Additionally, consider using alternative spell-checking libraries that do not have known vulnerabilities.
Conclusion
The spellcheckpy package has been compromised with malicious code that poses serious security threats. Users are urged to uninstall the affected versions and monitor their applications for vulnerabilities. Utilizing tools like Vulert can help maintain security in open-source software.
See every vulnerability recorded for spellcheckpy →
FAQ
The vulnerability involves malicious code that executes upon importing the package, allowing for remote command execution and data exfiltration.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Immediately uninstall the affected versions (1.1.0 and 1.2.0) and update to a secure version if available.
Yes, consider using other spell-checking libraries such as pyspellchecker or textblob, which do not have known vulnerabilities.
The malicious code downloads additional scripts and establishes a connection to a remote server, allowing attackers to execute commands on the victim's machine.
