Malicious Code Injection in num2words Package: A Security Breach
Summary
MAL-2025-6794: Malicious code in num2words (PyPI). Affects num2words versions 0.5.15 – 0.5.16. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The num2words package is a Python library that converts numbers into words, supporting multiple languages. It is widely used in applications that require text representation of numerical values. However, the package was recently compromised, leading to the release of malicious versions that could potentially harm users and their applications.
Vulnerability Detail
The vulnerability originated from a phishing attack that compromised the num2words project. Two new versions (0.5.15 and 0.5.16) were uploaded to the Python Package Index (PyPI) containing malicious code. This could lead to unauthorized access, data breaches, or other malicious activities when users install these compromised versions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall num2wordsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not possible, consider using a previous version of the package that is known to be safe. You can install a specific version using the command: pip install num2words==0.5.14.
Conclusion
The num2words package has been compromised, leading to the release of malicious versions that pose significant security risks. Users are advised to update to a safe version immediately and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for num2words →
FAQ
Versions 0.5.15 and 0.5.16 of the num2words package are affected by the malicious code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If you have installed the malicious version, immediately uninstall it using pip uninstall num2words and then install a safe version.
Regularly monitor your dependencies for vulnerabilities using tools like Vulert, and ensure that you only install packages from trusted sources.
Using the compromised package could lead to unauthorized access to your system, data breaches, or execution of malicious code that could harm your application.
Related vulnerabilities
Recent vulnerabilities recorded for num2words.
