THE INCIDENT
Trusted software became a business risk because trust itself was exploited.
In January 2026, security researchers identified two malicious Python packages on PyPI — spellcheckerpy and spellcheckpy — that pretended to be connected to the legitimate pyspellchecker project. They looked credible enough to fool developers, but were designed to deliver a remote access trojan instead.
That may sound like a narrow developer problem.
It isn’t.
Modern software teams increasingly rely on open-source packages they did not write, do not fully inspect, and often install in seconds. When one of those packages is malicious — or simply looks close enough to a trusted one — the risk can become a direct route into systems, credentials, and sensitive development environments.
WHAT ACTUALLY HAPPENED
A trusted route delivered an untrusted result.
The breach can be understood in three simple steps.
01
A trusted destination
People went to a trusted software site.
02
A familiar action
They clicked what looked like a normal download link.
03
A compromised delivery
Some received malware instead of the legitimate tool.
The attacker did not need to rewrite CPUID’s software to cause serious harm.
According to multiple reports, the malicious package paired a real signed executable with a malicious DLL called CRYPTBASE.dll. That DLL launched a multi-stage malware chain which ultimately delivered STX RAT, a remote access trojan associated with credential theft and ongoing access to compromised machines.
Non-technical readers do not need to remember the file names. The important distinction is that the attacker only needed to interfere with how the software was delivered. The delivery path can be just as dangerous as the application.
WHY THIS MATTERS BEYOND IT
More than 150 victims across multiple sectors.
CPU-Z and HWMonitor are widely used utilities, especially by IT professionals, administrators, engineers and support teams. Kaspersky said it identified more than 150 victims, including organisations across retail, manufacturing, consulting, telecommunications and agriculture.
This was a compromise of a trusted channel used by people who often have elevated access, sensitive credentials and visibility into important systems.
01
Browser-stored credentials
02
Session cookies
03
Privileged access
04
Internal systems
05
Follow-on compromise
THE LEADERSHIP LESSONS
Software risk extends beyond whether your developers wrote good code.
The real lesson is not simply to “be more careful downloading files.” It is to understand the wider software estate.
01
Third-party reliance
What third-party software, tools and dependencies do your teams rely on?
02
Component visibility
What components and dependencies exist across your software estate?
03
Software provenance
Where did the software come from, and can that origin be verified?
04
Unexpected change
Would you know if a trusted component or delivery path changed unexpectedly?
05
Speed of response
How quickly can you assess exposure when something trusted is compromised?
WHEN TRUST IS COMPROMISED
Leadership needs answers, not manual guesswork.
When a supplier, tool, dependency or download path is compromised, the first question is no longer only, “Was the vendor breached?” The organisation must be able to understand its own exposure.
Where are we exposed?
01
What systems are affected?
02
What credentials might be at risk?
03
What do we need to do now?
04
If those answers are slow, unclear or dependent on manual guesswork, the business is already behind.
THE CODE REGISTRY FITS
You cannot manage software risk if you do not understand your software estate.
The Code Registry is not a download filter. But this breach shows why organisations need evidence-based visibility into the code, components, third-party exposure and risk sitting inside their software environment.
EVIDENCE-BASED VISIBILITY
Understand the risk. Explain it
clearly.
01
Code and components
Know what code and components the organisation relies on.
02
Third-party exposure
See where external dependencies and suppliers create exposure.
03
Software risk
Understand what risk is sitting inside the software environment.
04
Clear reporting
Explain risk to both technical and non-technical stakeholders.
TRUST IS NO LONGER ENOUGH
Software assurance requires visibility, provenance and independent verification.
A known vendor can be legitimate. A signed executable can be legitimate. The software can still become dangerous if the delivery chain is compromised.
For technical teams, that means better validation, monitoring and incident response. For leadership teams, it means moving beyond brand trust towards evidence.
Software risk lives in dependencies, delivery paths, third-party tools and blind spots across the software estate. Organisations need visibility. They need evidence. They need to know their code.
FROM COMPLEXITY TO CLARITY
Move from uncertainty to complete code confidence.
Get the independent intelligence you need to understand, verify and protect your software.
Book a demo