MAL-2026-375

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/spellcheckerpy/MAL-2026-375.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-375
Published
2026-01-20T19:06:25Z
Modified
2026-03-13T06:45:02.225785Z
Summary
Malicious code in spellcheckerpy (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (79cc4c6495567fe7659e9e4bb5964727bf95cfc9f78d32209937d73457bd476b)

Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in background periodically connects to a remote host and waits for the next code to execute.

The malicious code was in version 1.3.0, but the package itself was clearly uploaded with malclious intentions.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-11-spellcheckers

Reasons (based on the campaign):

  • obfuscation

  • Downloads and executes a remote malicious script.

  • The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

Database specific 
{
    "iocs": {
        "domains": [
            "dothebest.store",
            "searchbox.info"
        ],
        "urls": [
            "https://dothebest.store/allow/inform.php",
            "https://dothebest.store/refresh.php",
            "https://searchbox.info/prefer.php"
        ]
    },
    "malicious-packages-origins": [
        {
            "sha256": "2ffcd3e16661799d1a55e0d5e359ffd6fb883256310f280d6e0b88a5edb4e626",
            "id": "pypi/2025-11-spellcheckers/spellcheckerpy",
            "versions": [
                "1.0.0",
                "1.1.0",
                "1.3.0"
            ],
            "import_time": "2026-01-20T19:29:07.146029539Z",
            "modified_time": "2026-01-20T19:06:25.794768Z",
            "source": "kam193"
        },
        {
            "sha256": "79cc4c6495567fe7659e9e4bb5964727bf95cfc9f78d32209937d73457bd476b",
            "id": "pypi/2025-11-spellcheckers/spellcheckerpy",
            "versions": [
                "1.0.0",
                "1.1.0",
                "1.3.0"
            ],
            "import_time": "2026-01-20T19:58:56.109232579Z",
            "modified_time": "2026-01-20T19:06:25.794768Z",
            "source": "kam193"
        },
        {
            "sha256": "10bb96df7d43eff438bbe7a555c333f9e1d02f837ee3636dcbf9aa9e22175c48",
            "id": "pypi/2025-11-spellcheckers/spellcheckerpy",
            "versions": [
                "1.0.0",
                "1.1.0",
                "1.3.0"
            ],
            "import_time": "2026-01-27T18:48:13.385350639Z",
            "modified_time": "2026-01-20T19:06:25.794768Z",
            "source": "kam193"
        },
        {
            "sha256": "14f2a6cb3c370817d9494648c7f7f19714f6b8985d936fe93d0d1685cd522fb2",
            "id": "pypi/2025-11-spellcheckers/spellcheckerpy",
            "versions": [
                "1.0.0",
                "1.1.0",
                "1.3.0"
            ],
            "import_time": "2026-01-28T19:11:43.695337747Z",
            "modified_time": "2026-01-20T19:06:25.794768Z",
            "source": "kam193"
        },
        {
            "sha256": "0812165e8c72368e5a52652b3e4ebad7b61dd0bee3368dbd47b8728ca2eaeaad",
            "id": "pypi/2025-11-spellcheckers/spellcheckerpy",
            "versions": [
                "1.0.0",
                "1.1.0",
                "1.3.0"
            ],
            "import_time": "2026-03-11T10:47:48.52324165Z",
            "modified_time": "2026-01-20T19:06:25.794768Z",
            "source": "kam193"
        }
    ]
}
References
Credits

Affected packages

PyPI / spellcheckerpy

Package

Name
spellcheckerpy
View open source insights on deps.dev
Purl
pkg:pypi/spellcheckerpy

Affected ranges

Affected versions

1.*
1.0.0
1.1.0
1.3.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/spellcheckerpy/MAL-2026-375.json"