{"id":"MAL-2026-16275","kind":"package","aliases":["MAL-2026-16275"],"related":[],"title":"Malicious code in requests-triwes (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (fa01be0759de95b7a1628930718f7b3bf372eff0c777aace419196e327e77078)\nDuring installation, package starts a reverse shell.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-requests-triwes\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"requests-triwes","fixed":[],"affected":"= 2.34.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-17T23:07:16+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':50C '-16275':10A,13A '-2026':9A,12A '2026':49C 'allow':68C 'attack':70C 'base':55C 'campaign':41C,48C,58C 'categori':38C 'clear':43C 'code':2A,62C,91C 'command':74C,85C 'contain':61C 'creat':64C 'detail':21C 'edit':24C 'execut':72C,89C 'fa01be0759de95b7a1628930718f7b3bf372eff0c777aace419196e327e77078':30C 'infosteal':47C 'instal':32C,84C,93C 'intent':45C 'kam193':29C 'like':46C 'line':27C 'machin':79C 'mal':8A,11A 'malici':1A,17B,39C,44C,90C 'overrid':82C 'packag':18B,33C,60C,81C 'per':19C 'pypi':7A 'reason':54C 'request':5A,52C 'requests':15A 'requests-triw':4A,51C 'requests-triwes':14A 'revers':36C,66C 'setup.py':87C 'shell':37C,67C 'sourc':20C,28C 'start':34C 'triw':6A,53C 'triwes':16A 'victim':77C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-17T23:07:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16275","url":"https://osv.dev/vulnerability/MAL-2026-16275","severity":"critical","published_at":"2026-09-17T23:07:16+00:00","modified_at":"2026-09-18T01:00:06+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}