{"id":"MAL-2025-191533","kind":"package","aliases":["MAL-2025-191533"],"related":[],"title":"Malicious code in spellcheckers (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (c83520810b148ec74e509b16851a1fafa1bec576b502a5debabd9b52520d9754)\nThis package is malicious and typosquating the legitimate pyspellchecker library.\nThis package will deploy a remote-access trojan that allows the attacker full\ncontrol of the victim's host.\n\n## Source: kam193 (6585d4c29dd97a1e46f30047c7d67a6e4bbb19f9b41bc1f9ff0b5fc34b839c75)\nPackage contains hidden code that is effectively run during importing and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for next code to execute\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2025-11-spellcheckers\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"spellcheckers","fixed":[],"affected":"all versions","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2025-11-15T18:49:10+00:00","first_seen_at":"2026-10-30T10:28:29+00:00","triaged_at":"2026-10-30T10:28:57+00:00","updated_at":"2026-10-30T10:28:57+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':110C '-191533':8A,11A '-2025':7A,10A '2025':109C '6585d4c29dd97a1e46f30047c7d67a6e4bbb19f9b41bc1f9ff0b5fc34b839c75':63C 'access':48C 'allow':51C 'attack':53C 'background':84C 'base':113C 'c83520810b148ec74e509b16851a1fafa1bec576b502a5debabd9b52520d9754':30C 'campaign':101C,108C,116C 'categori':98C 'clear':103C 'code':2A,67C,78C,95C,128C 'command':132C 'connect':86C 'contain':65C,127C 'control':55C 'deploy':44C 'detail':17C 'download':75C,118C 'edit':20C 'effect':70C 'execut':97C,120C,130C 'full':54C 'googl':26C 'google-open-source-secur':25C 'hidden':66C 'host':60C,90C 'import':73C 'infosteal':107C 'intent':105C 'kam193':62C 'legitim':38C 'librari':40C 'like':106C 'limit':134C 'line':23C 'machin':143C 'mal':6A,9A 'malici':1A,13B,34C,99C,104C,123C 'next':94C 'obfusc':117C 'open':27C 'packag':14B,32C,42C,64C,126C 'per':15C 'period':85C 'probabl':133C 'process':81C 'pypi':5A 'pyspellcheck':39C 'reason':112C 'remot':47C,89C,122C,131C 'remote-access':46C 'run':71C,82C 'script':124C 'second':76C 'secur':29C 'set':138C 'sourc':16C,24C,28C,61C 'specif':137C 'spellcheck':4A,111C 'spellcheckers':12A 'stage':77C 'trojan':49C 'typosqu':36C 'victim':58C,141C 'wait':92C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2025-11-15T18:49:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2025-191533","url":"https://osv.dev/vulnerability/MAL-2025-191533","severity":"critical","published_at":"2025-11-15T18:49:10+00:00","modified_at":"2026-10-30T09:45:05+00:00","first_seen_at":"2026-10-30T10:28:29+00:00","fetched_at":"2026-10-30T10:28:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}