{"id":"MAL-2026-15859","kind":"package","aliases":["MAL-2026-15859"],"related":[],"title":"Malicious code in 0requests (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ce3a594da2523b6481bd4639f5d3aaed9ec11a9adf92c2b99bf99d0ab6fb5b78)\nThe package name '0requests' is a one-character variant of the popular PyPI package 'requests'. On import of the top-level package, __init__.py enumerates os.environ and collects every variable whose name begins with SECRET, API, TOKEN, or KEY, then opens a TCP socket to a host/port taken from the TS_HOST and TS_PORT environment variables and sends the serialized dictionary of credential-shaped variables. The same import path spawns a python subprocess that connects to the same TS_HOST:TS_PORT, sends a 'SHELL' marker, and sleeps to keep the socket open, providing a remote-controlled shell channel on the host. Console output includes '0requests installed -- targeting requests' and a '[typosquat] exfiltrating' log line, confirming intent.\n\n## Source: kam193 (b42d4eed37375dfa065db35c2e08365b9557b442c935e645b3e82564c4c32d7c)\nDuring import, the code exfiltrates potentially sensitive env variables. In all analyzed versions the exfiltration target was a localhost, suggesting it was just a test.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: 2026-09-0requests\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-env-variables\n\n\n - typosquatting","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"0requests","fixed":[],"affected":"= 0.0.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-03T17:00:47+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-0':211C '-09':210C '-15859':8A,11A '-2026':7A,10A '0requests':4A,12A,32C,139C '2026':209C 'also':189C 'amazon':26C 'amazon-inspector':25C 'analyz':165C 'anyth':190C 'api':66C 'b42d4eed37375dfa065db35c2e08365b9557b442c935e645b3e82564c4c32d7c':153C 'base':214C 'begin':63C 'campaign':208C,217C 'categori':179C 'ce3a594da2523b6481bd4639f5d3aaed9ec11a9adf92c2b99bf99d0ab6fb5b78':28C 'channel':132C 'charact':37C 'clear':203C 'co':201C 'code':2A,157C 'collect':58C 'confirm':149C 'connect':107C 'consol':136C 'control':130C 'credenti':95C 'credential-shap':94C 'detail':17C 'dictionari':92C 'edit':20C 'enumer':55C 'env':161C,220C 'environ':86C 'everi':59C 'exfiltr':146C,158C,168C,219C 'exfiltration-env-vari':218C 'explor':195C 'harm':206C 'host':82C,112C,135C 'host/port':77C 'import':46C,100C,155C 'includ':138C 'init':53C 'inspector':27C 'instal':140C 'intent':150C 'kam193':152C 'keep':122C 'key':69C 'kit':199C 'level':51C 'like':184C,193C 'line':23C,148C 'localhost':172C 'log':147C 'look':183C,192C 'low':205C 'low-harm':204C 'mal':6A,9A 'malici':1A,13B 'marker':118C 'name':31C,62C 'one':36C 'one-charact':35C 'open':71C,125C 'os.environ':56C 'output':137C 'packag':14B,30C,43C,52C,182C,187C 'path':101C 'pentest':181C,186C 'per':15C 'popular':41C 'port':85C,114C 'possibl':207C 'potenti':159C 'pre':197C 'pre-prepar':196C 'prepar':198C 'probabl':180C 'provid':126C 'py':54C 'pypi':5A,42C 'python':104C 'reason':213C 'remot':129C 'remote-control':128C 'request':44C,142C,212C 'research':200C 'secret':65C 'send':89C,115C 'sensit':160C 'serial':91C 'shape':96C 'shell':117C,131C 'sleep':120C 'socket':74C,124C 'sourc':16C,24C,151C 'spawn':102C 'subprocess':105C 'suggest':173C 'taken':78C 'target':141C,169C 'tcp':73C 'test':178C,194C 'token':67C 'top':50C 'top-level':49C 'ts':81C,84C,111C,113C 'typic':185C 'typosquat':145C,222C 'variabl':60C,87C,97C,162C,221C 'variant':38C 'version':166C 'whose':61C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-03T17:00:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-15859","url":"https://osv.dev/vulnerability/MAL-2026-15859","severity":"critical","published_at":"2026-09-03T17:00:47+00:00","modified_at":"2026-09-04T01:00:05+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","fetched_at":"2026-10-26T20:51:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}