GHSA-jxr6-qrxx-2ph2 json
num2words subjected to phishing attack, two versions published containing malware
published last yr. modified 3mo ago also PYSEC-2025-72
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
The `num2words` project was compromised via a phishing attack and two new versions were uploaded to PyPI containing malicious code. The affected versions have been removed from PyPI, and users are advised to remove the affected versions from their environments.
Is GHSA-jxr6-qrxx-2ph2 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | num2words | >=0.5.15, <=0.5.16 1 listed version 2 listed versions |
no fix listed |
Classification
- Weakness
-
- CWE-506 Embedded Malicious Code
References
-
github.com
/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/num2words/MAL-2025-6
web
-
github.com
/pypa/advisory-database/tree/main/vulns/num2words/PYSEC-2025-72.yaml
web
-
github.com
/savoirfairelinux/num2words
package
-
nitter.tiekoetter.com
/SFLinux/status/1949906299308953827
web, evidence
-
stepsecurity.io
/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise
web, evidence
Sources
- GitHub Advisory GHSA-jxr6-qrxx-2ph2
- OSV PYSEC-2025-72
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.