Malicious Python Spellchecker Packages on PyPI Deliver Hidden Remote Access Trojan
Cybersecurity researchers have identified two malicious packages on the Python Package Index (PyPI) that masquerade as spellcheckers but are designed to deploy a remote access trojan (RAT). These packages, named `spellcheckerpy` and `spellcheckpy`, were collectively downloaded over 1,000 times before their removal from PyPI.
The threat actor behind these packages employed a sophisticated method to conceal the malicious payload. Instead of embedding the harmful code directly into the main scripts, they hid it within a file named `resources/eu.json.gz`, which purportedly contained Basque language word frequencies, mimicking legitimate data from the authentic `pyspellchecker` package.
The malicious behavior is triggered when the archive file is extracted using the `test_file()` function with specific parameters: `test_file(eu, utf-8, spellchecker)`. This action decodes a Base64-encoded downloader hidden under the key spellchecker within the dictionary.
Initially, the first three versions of these packages only fetched and decoded the payload without executing it. However, with the release of `spellcheckpy` version 1.2.0 on January 21, 2026, the package gained the capability to execute the payload upon importation of the `SpellChecker` module.
The first stage of the attack involves a downloader that retrieves a Python-based RAT from an external domain (`updatenet[.]work`). This RAT is capable of fingerprinting the compromised host, parsing incoming commands, and executing them. Notably, the domain was registered in late October 2025 and is associated with the IP address 172.86.73[.]139, managed by RouterHosting LLC (also known as Cloudzy), a hosting provider previously linked to nation-state groups.
This incident is not isolated. In November 2025, HelixGuard discovered a similar malicious package named `spellcheckers` on PyPI, which also featured the ability to retrieve and execute a RAT payload. The similarities between these attacks suggest they may be orchestrated by the same threat actor.
The discovery of these malicious packages underscores the ongoing threats within open-source repositories. Developers are urged to exercise caution when selecting and integrating third-party packages into their projects. Verifying the authenticity and security of packages before use is crucial to prevent potential security breaches.
