Num2words PyPI Package Compromised

Comments (5)

varunsharma07 · 20h ago

Popular Python Package num2words v0.5.15 Published Without Repository Tag, Linked to Known Threat Actor

vdupras · 16h ago

What a blast from the past, I created that library, what more than a decade ago? How simpler the world was back then. This was used by nobody except us for our little shitty use case. How noisy this project has become!

arjvik · 12h ago

who currently has control over the package on PyPI? wondering how it was compromised

tardyp · 1h ago

New maintainers never bothered to change the range.. History num2words is based on an old library, pynum2word, created by Taro Ogawa in 2003. Unfortunately, the library stopped being maintained and the author can't be reached. There was another developer, Marius Grigaitis, who in 2011 added Lithuanian support, but didn't take over maintenance of the project.

I am thus basing myself on Marius Grigaitis' improvements and re-publishing pynum2word as num2words.

Virgil Dupras, Savoir-faire Linux

vdupras · 11h ago

I have no idea, it hasn't been me for years.

LLM Inevitabilism (tomrenner.com)

Do not download the app, use the website (idiallo.com)

Kiro: A new agentic IDE (kiro.dev)

CARA – High precision robot dog using rope (aaedmusa.com)

Show HN: Tinder but it's only pictures of my wife and I can only swipe right (trytender.app)

Linux Reaches 5% Desktop Market Share in USA (ostechnix.com)

EU age verification app to ban any Android system not licensed by Google (reddit.com)

Dumb Pipe (dumbpipe.dev)

Valve confirms credit card companies pressured it to delist certain adult games (pcgamer.com)

Performance and telemetry analysis of Trae IDE, ByteDance's VSCode fork (github.com)

Enough AI copilots, we need AI HUDs (geoffreylitt.com)

Hyatt Hotels are using algorithmic Rest “smoking detectors” (twitter.com)

Copyparty – Turn almost any device into a file server (github.com)

‘I witnessed war crimes’ in Gaza – former worker at GHF aid site [video] (bbc.com)

How to Firefox (kau.sh)

Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say (washingtonpost.com)

Show HN: Use Their ID – Use your local UK MP’s ID for the Online Safety Act (use-their-id.com)

Reflections on OpenAI (calv.info)

Qwen3-Coder: Agentic coding in the world (qwenlm.github.io)

AI overviews cause massive drop in search clicks (arstechnica.com)

It's time for modern CSS to kill the SPA (jonoalderson.com)

Graphene OS: a security-enhanced Android build (lwn.net)

Ukrainian hackers destroyed the IT infrastructure of Russian drone manufacturer (prm.ua)

ChatGPT agent: bridging research and action (openai.com)

Windsurf employee #2: I was given a payout of only 1% what my shares where worth (twitter.com)

Mistral Releases Deep Research, Voice, Projects in Le Chat (mistral.ai)

VPN use surges in UK as new online safety rules kick in (ft.com)

Cops say criminals use a Google Pixel with GrapheneOS – I say that's freedom (androidauthority.com)

Tom Lehrer has died (nytimes.com)

The United States withdraws from UNESCO (state.gov)

XMLUI (blog.jonudell.net)

TrackWeight: Turn your MacBook's trackpad into a digital weighing scale (github.com)

Steam, Itch.io are pulling ‘porn’ games. Critics say it's a slippery slope (wired.com)

My Self-Hosting Setup (codecaptured.com)

Show HN: Shoggoth Mini – A soft tentacle robot powered by GPT-4o and RL (matthieulc.com)

Ozzy Osbourne has died (bbc.co.uk)

Coding with LLMs in the summer of 2025 – an update (antirez.com)

Rust running on every GPU (rust-gpu.github.io)

Oakland cops gave ICE license plate data; SFPD also illegally shared with feds (sfstandard.com)

Cloudflare 1.1.1.1 Incident on July 14, 2025 (blog.cloudflare.com)

Death by AI (davebarry.substack.com)

You can now disable all AI features in Zed (zed.dev)

Claude Code weekly rate limits

New colors without shooting lasers into your eyes (dynomight.net)

Complete silence is always hallucinated as "ترجمة نانسي قنقر" in Arabic (github.com)

Visa and Mastercard are getting overwhelmed by gamer fury over censorship (polygon.com)

Women dating safety app 'Tea' breached, users' IDs posted to 4chan (404media.co)

UK backing down on Apple encryption backdoor after pressure from US (arstechnica.com)

Ask HN: Is it time to fork HN into AI/LLM and "Everything else/other?"

Apple's MLX adding CUDA support (github.com)

Num2words PyPI Package Compromised

Comments (5)