{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "num2words"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.15"
            },
            {
              "last_affected": "0.5.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-506"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-31T19:33:29Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "The `num2words` project was compromised via a phishing attack and two new versions were uploaded to PyPI containing malicious code. The affected versions have been removed from PyPI, and users are advised to remove the affected versions from their environments.",
  "id": "GHSA-jxr6-qrxx-2ph2",
  "modified": "2025-07-31T19:33:29Z",
  "published": "2025-07-31T19:33:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/num2words/PYSEC-2025-72.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/savoirfairelinux/num2words"
    },
    {
      "type": "WEB",
      "url": "https://nitter.tiekoetter.com/SFLinux/status/1949906299308953827"
    },
    {
      "type": "WEB",
      "url": "https://www.stepsecurity.io/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "num2words subjected to phishing attack, two versions published containing malware"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "num2words",
        "purl": "pkg:pypi/num2words"
      },
      "versions": [
        "0.5.15",
        "0.5.16"
      ]
    }
  ],
  "credits": [
    {
      "name": "Mike Fiedler",
      "type": "COORDINATOR"
    }
  ],
  "details": "The `num2words` project was compromised via a phishing attack\nand two new versions were uploaded to PyPI containing malicious code.\nThe affected versions have been removed from PyPI,\nand users are advised to remove the affected versions from their environments.\n",
  "id": "PYSEC-2025-72",
  "modified": "2025-07-31T14:34:47+00:00",
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://nitter.tiekoetter.com/SFLinux/status/1949906299308953827"
    },
    {
      "type": "EVIDENCE",
      "url": "https://www.stepsecurity.io/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise"
    }
  ],
  "summary": "After a successful phishing attack, new versions of `num2words` were published containing malware."
}