MAL-2025-191857

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/requtils/MAL-2025-191857.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-191857
Published
2025-11-18T00:29:33Z
Modified
2026-03-19T12:56:31Z
Summary
Malicious code in requtils (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (58a7ebfdccf4fd67fac4e6a3c3183918f4682e004468286a5675622ae6fc35c5)

Package attempts to automatically exfiltrate API keys

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-11-requtils

Reasons (based on the campaign):

  • exfiltration-credentials
Database specific 
{
    "iocs":  {
        "urls":  [
            "https://catheryn-theocratic-conjecturally.ngrok-free.dev/webhook"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2025-11-requtils/requtils",
            "import_time":  "2025-12-02T22:30:55.54391925Z",
            "modified_time":  "2025-11-18T00:29:33.360226Z",
            "sha256":  "fe6a750c7905b4055bb50dd510881095279e4d4b8516d24f6be8366b4030d9cb",
            "source":  "kam193",
            "versions":  [
                "1.0.2",
                "1.0.1",
                "1.0.0"
            ]
        },
        {
            "id":  "pypi/2025-11-requtils/requtils",
            "import_time":  "2025-12-02T23:07:18.582796284Z",
            "modified_time":  "2025-11-18T00:29:33.360226Z",
            "sha256":  "58a7ebfdccf4fd67fac4e6a3c3183918f4682e004468286a5675622ae6fc35c5",
            "source":  "kam193",
            "versions":  [
                "1.0.2",
                "1.0.1",
                "1.0.0"
            ]
        },
        {
            "id":  "RLMA-2025-06587",
            "import_time":  "2025-12-24T10:07:31.257206041Z",
            "modified_time":  "2025-12-23T08:39:37Z",
            "sha256":  "b59fcdda302a7ab5ee48d61ff27e907a0116b426f930ab8910a455ed611833f0",
            "source":  "reversing-labs",
            "versions":  [
                "1.0.0",
                "1.0.1",
                "1.0.2"
            ]
        },
        {
            "id":  "pypi/2025-11-requtils/requtils",
            "import_time":  "2025-12-30T22:39:04.161637597Z",
            "modified_time":  "2025-11-18T00:29:33.360226Z",
            "sha256":  "30f58750066fe3e80b742e5df55e3efffc40d36545e31f97d137b60ee31cf3f2",
            "source":  "kam193",
            "versions":  [
                "1.0.0",
                "1.0.1",
                "1.0.2"
            ]
        },
        {
            "id":  "RLUA-2026-00717",
            "import_time":  "2026-03-19T12:20:23.540736455Z",
            "modified_time":  "2026-03-18T12:18:19Z",
            "sha256":  "87815bb56ad05ee04b068c4b387e2b6e540bee2546c20cdc124e9b2601397835",
            "source":  "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

PyPI / requtils

Package

Name
requtils
View open source insights on deps.dev
Purl
pkg:pypi/requtils

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/requtils/MAL-2025-191857.json"