MAL-2026-1261

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/fastapi-requests/MAL-2026-1261.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-1261
Published
2026-03-06T11:35:54Z
Modified
2026-03-06T12:35:04.349100Z
Summary
Malicious code in fastapi-requests (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (8e414a858711540d25b63ced50114d396e150157b65a70056beccc38948a4199)

The package clones a legitimate library and contains hidden code that executes remote scripts. During the analysis, the remote code was no longer available

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-03-fastapi-requests

Reasons (based on the campaign):

  • Downloads and executes a remote malicious script.

  • clones-real-package

  • typosquatting

  • action-hidden-in-lib-usage

Database specific 
{
    "iocs": {
        "domains": [
            "cleverstack-ext30341.vercel.app"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-03-fastapi-requests/fastapi-requests",
            "sha256": "8e414a858711540d25b63ced50114d396e150157b65a70056beccc38948a4199",
            "source": "kam193",
            "versions": [
                "0.0.0",
                "2.32.5"
            ],
            "modified_time": "2026-03-06T11:35:54.724047Z",
            "import_time": "2026-03-06T12:15:45.60883526Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / fastapi-requests

Package

Name
fastapi-requests
View open source insights on deps.dev
Purl
pkg:pypi/fastapi-requests

Affected ranges

Affected versions

0.*
0.0.0
2.*
2.32.5

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/fastapi-requests/MAL-2026-1261.json"