{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0.5.15","last_affected":"0.5.16"}],"component":"num2words","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-jxr6-qrxx-2ph2","id":"tcs_01M5KFPVN3G004FTH0HH1Y6MJM","modified_at":"2026-07-30T05:15:37.523417714Z","published_at":"2025-07-31T19:33:29Z","references":["https://osv.dev/vulnerability/GHSA-jxr6-qrxx-2ph2","https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/num2words/MAL-2025-6794.json","https://github.com/pypa/advisory-database/tree/main/vulns/num2words/PYSEC-2025-72.yaml","https://github.com/savoirfairelinux/num2words","https://nitter.tiekoetter.com/SFLinux/status/1949906299308953827","https://www.stepsecurity.io/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-jxr6-qrxx-2ph2","url":"https://osv.dev/vulnerability/GHSA-jxr6-qrxx-2ph2"}],"summary":"num2words subjected to phishing attack, two versions published containing malware"}