Critical Vulnerability in num2words: Phishing Attack Leads to Malicious Code Injection
Summary
GHSA-jxr6-qrxx-2ph2: num2words subjected to phishing attack, two versions published containing malware. Affects num2words versions >= 0.5.15, <= 0.5.16. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The num2words package is a Python library that converts numbers into words, supporting multiple languages. It is widely used in applications requiring numerical representation in textual form. However, the package was recently compromised, leading to the release of malicious versions that could potentially harm users' systems.
Vulnerability Detail
The vulnerability originated from a phishing attack that compromised the num2words project. Two malicious versions were uploaded to the Python Package Index (PyPI), which contained harmful code. Users who installed these versions could face serious security risks, including unauthorized access to their systems and data breaches. The affected versions, 0.5.15 and 0.5.16, have been removed from PyPI, but users who have not updated their installations remain at risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot update the package immediately, consider using an alternative library for number-to-word conversion or implement a temporary solution by manually converting numbers to words in your application until you can safely update num2words.
Conclusion
The num2words package has been compromised due to a phishing attack, leading to the release of malicious versions. Users are strongly advised to uninstall the affected versions and update to a secure version to protect their systems from potential threats. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for num2words →
FAQ
The affected versions are 0.5.15 and 0.5.16.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You should uninstall the affected versions and upgrade to a safe version of num2words.
Using the compromised versions could lead to unauthorized access to your system and potential data breaches.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
Related vulnerabilities
Recent vulnerabilities recorded for num2words.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
