Quick Summary
Cybersecurity researchers identified two malicious packages on the Python Package Index (PyPI) that masquerade as spellcheckers but deliver a remote access trojan (RAT). The packages, spellcheckerpy and spellcheckpy, were downloaded over 1,000 times before being removed. The RAT was hidden in a Basque language dictionary file and was designed to execute commands on compromised hosts, raising significant security concerns for Python developers and users.
The Securityish Brief
Researchers discovered two malicious packages, spellcheckerpy and spellcheckpy, on the Python Package Index (PyPI) that were designed to deliver a remote access trojan (RAT). These packages were collectively downloaded just over 1,000 times before they were removed from the repository. The malicious functionality was hidden within a Basque language dictionary file, which contained a base64-encoded payload that downloads a full-featured Python RAT.
The attack was initiated when the user imported the package, triggering the execution of the payload. The malicious behavior was not present in the first three versions of the package, which only fetched the payload without executing it. However, with the release of spellcheckpy version 1.2.0 on January 21, 2026, the package gained the ability to run the payload, significantly increasing its threat level.
The RAT is designed to retrieve commands from an external domain and execute them on the compromised host. This domain, registered in late October 2025, is linked to RouterHosting LLC, a provider known for offering services to nation-state groups. This incident is part of a broader trend of malicious packages targeting developers, as evidenced by previous attacks involving fake spell-checking tools.
In November 2025, another malicious package named “spellcheckers” was discovered, which also had the capability to execute a RAT payload. This suggests that the same threat actor may be behind both campaigns, highlighting a persistent risk in the software supply chain.
Implications for Users and Developers
The emergence of these malicious packages underscores the importance of vigilance among Python developers and users. As the software supply chain becomes increasingly targeted, users must be cautious about the packages they download and utilize. The use of reputable sources and thorough vetting of packages can help mitigate risks.
Furthermore, developers should consider implementing additional security measures, such as monitoring for unusual behavior in their applications and keeping their software dependencies up to date. Awareness of potential threats, including similar attacks that may use social engineering tactics to lure users, is crucial for maintaining security.
As the landscape of cybersecurity continues to evolve, staying informed about recent threats and adopting best practices will be essential for protecting both personal and organizational data.
Key Takeaways
- Verify the source of any Python packages before downloading to avoid malicious software.
- Regularly update software dependencies to protect against known vulnerabilities.
- Monitor application behavior for unusual activity that may indicate a security breach.
- Educate team members about the risks of downloading unverified packages and the importance of software supply chain security.
- Implement security tools that can detect and alert on suspicious package behavior.
Key Terms & Concepts
- Remote Access Trojan (RAT): In this article, a RAT refers to malware that allows an attacker to control a compromised computer remotely.
- Python Package Index (PyPI): PyPI is a repository for Python software packages where developers can publish and share their code.
- Base64: Base64 is a method for encoding binary data into a text format that can be easily transmitted over text-based protocols.
Read the original article here: https://thehackernews.com/2026/01/fake-python-spellchecker-packages-on.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
