Num2words PyPI Package Compromised

https://www.stepsecurity.io/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise

by varunsharma07 • 12 months ago

22 6 12 months ago

Popular Python Package num2words v0.5.15 Published Without Repository Tag, Linked to Known Threat Actor

vdupras2• 12 months ago

What a blast from the past, I created that library, what more than a decade ago? How simpler the world was back then. This was used by nobody except us for our little shitty use case. How noisy this project has become!

arjvik• 12 months ago

who currently has control over the package on PyPI? wondering how it was compromised

vdupras2• 12 months ago

I have no idea, it hasn't been me for years.

tardyp• 12 months ago

New maintainers never bothered to change the range.. History num2words is based on an old library, pynum2word, created by Taro Ogawa in 2003. Unfortunately, the library stopped being maintained and the author can't be reached. There was another developer, Marius Grigaitis, who in 2011 added Lithuanian support, but didn't take over maintenance of the project.

I am thus basing myself on Marius Grigaitis' improvements and re-publishing pynum2word as num2words.

Virgil Dupras, Savoir-faire Linux

zahlman• 12 months ago

The compromise was first identified through several concerning indicators:
Missing Repository Tag: Unlike previous releases, version 0.5.15 was published to PyPI without a corresponding tag in the official GitHub repository at https://github.com/savoirfairelinux/num2words/tags
Timing Discrepancy: The package appeared on PyPI without any associated commits or release activities in the source repository
Community Alert: Security researcher @johnk3r quickly raised the alarm on social media, warning the community about potential compromise

This is one of the AI "tells" that I find especially strange. It doesn't just overuse these bullet-point lists; it puts things in the list that clearly don't belong.

The "community alert", of course, is not a "concerning indicator" that was used to identify the compromise.

But if you take that out, "several" is a strange way to describe "two", and the whole thing would clearly be better written as free-form prose.

Num2words PyPI Package Compromised

Related Stories