Loading story…
Security researchers at Aikido identified two malicious Python packages on the Python Package Index (PyPI)—spellcheckerpy and spellcheckpy—masquerading as legitimate spell-checking utilities but containing hidden functionality to deliver a remote access trojan (RAT). The packages were removed from PyPI after being downloaded a little over 1,000 times, highlighting ongoing software supply-chain risk in public repositories.
Analysis indicates the attacker hid a Base64-encoded payload inside a Basque-language dictionary resource (resources/eu.json.gz) copied from the legitimate pyspellchecker project, rather than placing obvious malicious logic in __init__.py. Early releases were intentionally dormant (payload present but not executed), but spellcheckpy v1.2.0 introduced an obfuscated execution trigger that runs on import and can be activated via a function call such as test_file("eu", "utf-8", "spellchecker"), which extracts the embedded downloader under a spellchecker key. The downloader retrieves a Python RAT from updatenet[.]work, a domain linked to infrastructure (including 172.86.73[.]139) associated with malicious hosting activity, and the RAT supports host fingerprinting, command parsing, and remote command execution.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
The malicious spellcheckerpy and spellcheckpy packages were removed from PyPI after they had been downloaded more than 1,000 times. Their removal followed public identification of the packages' hidden RAT functionality.
Aikido researchers identified spellcheckerpy and spellcheckpy as malicious packages delivering a remote access trojan through PyPI, and linked the hosting infrastructure to an IP operated by RouterHosting LLC (Cloudzy). The campaign was also noted as resembling a November 2025 fake spell-checking package incident.
Attackers published the PyPI packages spellcheckerpy and spellcheckpy, masquerading as spell-checking tools while concealing a Base64-encoded malicious payload inside a Basque dictionary resource file. Early versions contained dormant or downloader-only functionality that did not yet execute the full malware on import.
Version 1.2.0 of spellcheckpy was released with an obfuscated trigger that executed on import, activating a downloader to retrieve a Python-based remote access trojan from updatenet[.]work. This marked the shift from hidden staging logic to active malware delivery.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **developer supply-chain** threats abusing trusted ecosystems to steal data or deliver malware. In Microsoft’s **VS Code Marketplace**, two AI-themed extensions—**ChatGPT – 中文版** (publisher *WhenSunset*, ~1.34M installs) and **ChatMoss (CodeMoss)** (publisher *zhukunpeng*, ~150K installs)—were found exfiltrating developer data to **China-based servers** without disclosure or consent. Koi Security attributed the activity to a campaign dubbed **“MaliciousCorgi,”** noting shared code and common backend infrastructure; the extensions reportedly monitor files opened in VS Code and transmit full contents (Base64-encoded), including subsequent changes. Separately, malicious **PyPI** packages **spellcheckerpy** and **spellcheckpy** impersonated the legitimate *pyspellchecker* project and embedded a Base64-encoded downloader inside a seemingly legitimate Basque dictionary resource (`resources/eu.json.gz`). Aikido reported the attacker first published “dormant” versions (payload present but not executed), then enabled execution in **spellcheckpy v1.2.0** by adding an obfuscated trigger that runs on import/initialization (e.g., when importing `SpellChecker`), ultimately downloading a **full-featured Python RAT**. Together, the incidents reinforce the risk of installing unvetted extensions and packages, even when they appear functional and reference legitimate upstream repos.
Jun 29, 2026
Securonix reported a phishing campaign distributing **PY#RATION**, a Python-based remote access trojan targeting Windows systems through password-protected ZIP archives that contain malicious `.lnk` shortcut files. Once launched, the malware establishes persistence and gives operators broad access to infected hosts, including remote command execution, keylogging, file transfer, clipboard theft, browser credential and cookie extraction, and host and antivirus enumeration. Newer variants also added network-scanning capability and stronger anti-detection features as the malware evolved from version `1.0` to `1.6.0`. The campaign stood out for using **WebSockets** through Python Socket.IO for command-and-control and data exfiltration, alongside **Fernet**-obfuscated Python code to hinder analysis. Securonix linked activity to infrastructure centered on `169.239.129.108`, with staged payload delivery from domains including `install.realproheros[.]com` and Pastebin, and observed status callbacks to `api.safeit[.]com`. Researchers also noted overlap with a Python-packed infostealer executable named `one.exe`, indicating the operators were expanding tooling and refining methods to avoid detection.
Aug 15, 2026
A malicious npm package, **`postcss-minify-selector-parser`**, impersonated the legitimate **`postcss-selector-parser`** library in a software supply-chain attack and installed a multi-stage Windows remote access trojan on developer machines. Researchers linked the package to **`postcss-minify-selector`** and **`aes-decode-runner-pro`**, all published under the name **`abdrizak`**, and found the malware executed on import, decoded an embedded payload, dropped a PowerShell downloader, and fetched additional components from **`nvidiadriver[.]net`** before launching Nuitka-compiled modules through a renamed Python launcher. The recovered implant communicated with **`95[.]216[.]92[.]207:8080`** over encrypted HTTP POST traffic and supported remote shell access, file transfer, persistence, host profiling, and anti-VM checks. It also targeted **Google Chrome** saved logins and extension data, including newer app-bound encryption protections, while maintaining persistence through the **HKCU Run** registry key and tracking victims with files under **`%TEMP%`**. Defenders were advised to remove the malicious packages, inspect dependency trees and Windows artifacts such as **`%TEMP%\winPatch`** and **`chost.exe`/`loader.py`** execution, block the listed indicators, and rotate credentials from affected developer systems.
Aug 11, 2026