Malicious Code Injection in num2words Package Following Phishing Attack
Summary
PYSEC-2025-72: After a successful phishing attack, new versions of num2words were published containing malware. Affects num2words versions 0.5.15 – 0.5.16. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The num2words package is a Python library that converts numbers into words in various languages. It is widely used in applications that require number formatting for readability and presentation. However, the package was recently compromised, leading to the release of malicious versions that could potentially harm users' environments.
Vulnerability Detail
The vulnerability originated from a successful phishing attack on the maintainers of the num2words project. This attack allowed the attacker to upload two new versions of the package to the Python Package Index (PyPI) containing malware. Users who installed these versions may have inadvertently executed malicious code, leading to potential data breaches or system compromises.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the num2words package until they have confirmed that they are using a safe version. Additionally, consider using alternative libraries for number-to-word conversion until the issue is fully resolved.
Conclusion
The num2words package has been compromised due to a phishing attack, resulting in the release of malicious versions. Users are strongly advised to remove any affected versions and update to secure releases. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for num2words →
FAQ
The specific versions that were compromised have been removed from PyPI. Users should check their installed versions against the official repository to ensure they are not using the affected ones.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed a compromised version of num2words, you should uninstall it immediately and update to a secure version using 'pip uninstall num2words' followed by 'pip install num2words'.
To prevent similar vulnerabilities, always verify the source of packages before installation, use tools like Vulert for monitoring, and keep your dependencies updated.
Using the compromised version could lead to unauthorized access to your system, data loss, or other malicious activities performed by the malware embedded in the package.
Related vulnerabilities
Recent vulnerabilities recorded for num2words.
