{"id":"MAL-2026-15860","kind":"package","aliases":["MAL-2026-15860"],"related":[],"title":"Malicious code in py-0requests (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bd1f4c6176eadca0e4a460d4434e9957eb9befa90d85feecd49e4baf7f3abb4b)\npy-0requests is a homoglyph typosquat of the PyPI package `requests` (letter `o` replaced with digit `0`). On `import py_0requests`, top-level code in the package's `__init__.py` scrapes `os.environ` for keys prefixed with SECRET, API, TOKEN, or KEY and sends the collected dictionary over a TCP socket to a host/port read from `TS_HOST`/`TS_PORT` (defaulting to 127.0.0.1:9999). The same import path spawns a Python subprocess that opens a TCP connection to the same destination, sends a `SHELL` marker, and holds the socket open, providing a reverse-shell handshake to whichever operator controls the destination. The package's CLI banner self-identifies as `targeting requests` and ships no HTTP-client API.\n\n## Source: kam193 (0d447dd088f92d3af66ecad461725f2df268f5f073e22a7293b3f946451933fb)\nDuring import, the code exfiltrates potentially sensitive env variables. In all analyzed versions the exfiltration target was a localhost, suggesting it was just a test.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: 2026-09-0requests\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-env-variables\n\n\n - typosquatting","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"py-0requests","fixed":[],"affected":"= 0.0.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-03T17:01:32+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-0':214C '-09':213C '-15860':10A,13A '-2026':9A,12A '0':50C '0d447dd088f92d3af66ecad461725f2df268f5f073e22a7293b3f946451933fb':156C '0requests':6A,16A,35C,54C '127.0.0.1':96C '2026':212C '9999':97C 'also':192C 'amazon':30C 'amazon-inspector':29C 'analyz':168C 'anyth':193C 'api':72C,153C 'banner':140C 'base':217C 'bd1f4c6176eadca0e4a460d4434e9957eb9befa90d85feecd49e4baf7f3abb4b':32C 'campaign':211C,220C 'categori':182C 'clear':206C 'cli':139C 'client':152C 'co':204C 'code':2A,58C,160C 'collect':79C 'connect':110C 'control':133C 'default':94C 'destin':114C,135C 'detail':21C 'dictionari':80C 'digit':49C 'edit':24C 'env':164C,223C 'exfiltr':161C,171C,222C 'exfiltration-env-vari':221C 'explor':198C 'handshak':129C 'harm':209C 'hold':120C 'homoglyph':38C 'host':91C 'host/port':87C 'http':151C 'http-client':150C 'identifi':143C 'import':52C,100C,158C 'init':63C 'inspector':31C 'kam193':155C 'key':68C,75C 'kit':202C 'letter':45C 'level':57C 'like':187C,196C 'line':27C 'localhost':175C 'look':186C,195C 'low':208C 'low-harm':207C 'mal':8A,11A 'malici':1A,17B 'marker':118C 'o':46C 'open':107C,123C 'oper':132C 'os.environ':66C 'packag':18B,43C,61C,137C,185C,190C 'path':101C 'pentest':184C,189C 'per':19C 'port':93C 'possibl':210C 'potenti':162C 'pre':200C 'pre-prepar':199C 'prefix':69C 'prepar':201C 'probabl':183C 'provid':124C 'py':5A,15A,34C,53C,64C 'py-0requests':4A,14A,33C 'pypi':7A,42C 'python':104C 'read':88C 'reason':216C 'replac':47C 'request':44C,146C,215C 'research':203C 'revers':127C 'reverse-shel':126C 'scrape':65C 'secret':71C 'self':142C 'self-identifi':141C 'send':77C,115C 'sensit':163C 'shell':117C,128C 'ship':148C 'socket':84C,122C 'sourc':20C,28C,154C 'spawn':102C 'subprocess':105C 'suggest':176C 'target':145C,172C 'tcp':83C,109C 'test':181C,197C 'token':73C 'top':56C 'top-level':55C 'ts':90C,92C 'typic':188C 'typosquat':39C,225C 'variabl':165C,224C 'version':169C 'whichev':131C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-03T17:01:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-15860","url":"https://osv.dev/vulnerability/MAL-2026-15860","severity":"critical","published_at":"2026-09-03T17:01:32+00:00","modified_at":"2026-09-04T01:00:06+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","fetched_at":"2026-10-26T20:51:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}