MAL-2026-14133

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/reqcrypt/MAL-2026-14133.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14133
Published
2026-08-18T22:01:25Z
Modified
2026-08-19T00:30:18.049100646Z
Summary
Malicious code in reqcrypt (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688)

reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON keys named 'payloaddd', 'payloadgz', and 'payloadzlib', base64/gzip/zlib-decodes the associated values, and passes the decoded bytes to exec() inside the caller's Python process. This decode-and-exec path is wired into processresponse, which is invoked from every public verb (get/post/put/delete/patch/download/upload), so any server the caller contacts—or any network attacker able to tamper with a response—can push arbitrary Python code into the caller's process by adding one of those keys to a JSON body. In-source comments label the sinks as 'Hidden execution', and the behavior is not disclosed in the package's advertised API. Effect on any program using this library is a remote code execution channel driven by attacker-controlled or attacker-influenced HTTP responses.

Source: kam193 (556f2178ed2505024fd91bc1c9c20b59d78783c27badd166a220493e5184fb39)

The package contains a hidden backdoor. The promised functionality is an HTTP request library with some additional functions. On every usage, code secretly checks for the presence of specific fields in the response, and if they are found, their content is secretly executed.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-reqcrypt

Reasons (based on the campaign):

  • backdoor
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-18T22:43:10.388560939Z",
            "sha256": "556f2178ed2505024fd91bc1c9c20b59d78783c27badd166a220493e5184fb39",
            "modified_time": "2026-08-18T22:01:25.251379Z",
            "source": "kam193",
            "id": "pypi/2026-08-reqcrypt/reqcrypt",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "import_time": "2026-08-19T00:21:10.000859471Z",
            "sha256": "152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688",
            "modified_time": "2026-08-18T23:47:25Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018219",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / reqcrypt

Package

Name
reqcrypt
View open source insights on deps.dev
Purl
pkg:pypi/reqcrypt

Affected ranges

Affected versions

0.*
0.1.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/reqcrypt/MAL-2026-14133.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "d5957b900245596b9251e2f2fb083c62a94b572c92dfdd957941cbfc6f90c0ae",
            "tlsh": "d2c20f57dd82bc91c3cb88b9881aea53732bb81322481635bc7c429c2f91775c9f2dd9",
            "path": "reqcrypt/__init__.py"
        }
    ],
    "package_integrity": [
        {
            "filename": "reqcrypt-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "8bfd193a959da773d81c9f471aae1af8c587f5690cd5001902dc3ab8387454e6",
                "sha256": "6e29219f3dfe3b36aea8458f33521b160222e242da681434c4212c13efb21485",
                "md5": "4a72b58534d2078ca3d3aabf2aa4ff22"
            }
        },
        {
            "filename": "reqcrypt-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "4cd798e821b068ead2b3aee34f43a1a734c14262a2a0a11df515e16c76d675d6",
                "sha256": "a868335eb23ede7056456d858bdbcb369bbe5146f5acc69c89027b1c7041bbf1",
                "md5": "d1f48856f11b2ef20b000ac837d9c2d2"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]