GitHub Advisoryadvisory · PyPI

GHSA-jxr6-qrxx-2ph2 num2words subjected to phishing attack, two versions published containing malware

CRITICAL Published 2025-07-31 Modified 2026-07-21 Official page ↗
Ecosystem
PyPI
Packages
num2words
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-506
Reviewed
2025-07-31

Affected packages

• PyPI num2words: >= 0.5.15, <= 0.5.16 (no fix yet) • PyPI num2words: 0.5.15 (no fix yet) • PyPI num2words: 0.5.16 (no fix yet)

Description

The `num2words` project was compromised via a phishing attack and two new versions were uploaded to PyPI containing malicious code. The affected versions have been removed from PyPI, and users are advised to remove the affected versions from their environments.

Related

Weakness · CWE (1)

  • CWE-506 Embedded Malicious Code weakness

References