{"action":"No fix published. Pin and monitor.","affected":[],"component":"num2words","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-jxr6-qrxx-2ph2","id":"tcs_01M5KGPVDS3AGXTDPNK2BS4G3G","modified_at":"2025-08-06T04:27:26.046626Z","published_at":"2025-07-31T14:34:47Z","references":["https://osv.dev/vulnerability/PYSEC-2025-72","https://nitter.tiekoetter.com/SFLinux/status/1949906299308953827","https://www.stepsecurity.io/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2025-72","url":"https://osv.dev/vulnerability/PYSEC-2025-72"}],"summary":"After a successful phishing attack, new versions of `num2words` were published containing malware."}