Cybersecurity researchers have discovered two malicious packages in the Python Package Index (PyPI) repository that masqueraded as spellchecking utilities but contained remote access trojan (RAT) functionality.

Malicious Packages

Package NameDownloadsStatus
spellcheckerpy~500Removed
spellcheckpy~500Removed

The packages were collectively downloaded over 1,000 times before PyPI administrators removed them.

Attack Technique

Typosquatting: The malicious packages used names similar to legitimate spellchecking libraries, hoping developers would accidentally install them through:

  • Typos when running pip install
  • Copy-paste errors from documentation
  • Confusion with legitimate packages

Payload: Once installed, the packages delivered a remote access trojan (RAT) enabling attackers to:

  • Execute arbitrary commands
  • Exfiltrate sensitive data
  • Maintain persistent access
  • Move laterally within networks

Supply Chain Risk

This incident highlights ongoing risks in open-source package ecosystems:

  • Lack of vetting: Anyone can publish packages
  • Transitive dependencies: Malicious packages can be pulled in indirectly
  • Developer trust: Packages often run with full system privileges
  • CI/CD exposure: Build pipelines automatically install dependencies

Protection Measures

For developers:

  1. Verify package names carefully before installation
  2. Check package popularity, maintenance status, and publisher reputation
  3. Use dependency scanning tools (Snyk, Dependabot, etc.)
  4. Pin specific versions in requirements files
  5. Review package source code when possible

For organizations:

  1. Implement private package registries with approved packages
  2. Scan dependencies in CI/CD pipelines
  3. Monitor for unexpected network connections from build environments
  4. Use software composition analysis (SCA) tools

Broader Context

Malicious package campaigns have increased significantly, targeting:

  • PyPI (Python)
  • npm (JavaScript)
  • RubyGems (Ruby)
  • NuGet (.NET)

Developers should treat package installation as a security-sensitive operation.