Malicious PyPI Packages Distribute RAT via Hidden Payload

Cybersecurity researchers from Aikido identified two malicious packages, spellcheckerpy and spellcheckpy, on the Python Package Index (PyPI). These packages, disguised as spell-checking tools, contained a base64-encoded payload that deployed a remote access trojan (RAT) and were downloaded over 1,000 times before being removed. The malicious code was concealed within a Basque language dictionary file.