MAL-2026-14351

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/requests-crypt/MAL-2026-14351.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14351
Published
2026-08-21T10:33:24Z
Modified
2026-08-21T15:00:17.425047383Z
Summary
Malicious code in requests-crypt (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f971c743a8c6661c9078bdb6486843bb50831fadf9a9a6943e8231fac374ac2f)

requests-crypt wraps an HTTP client so that every JSON response passes through a DataProcessor that reads a configurable field (default 'cos') from the response body, base64-decodes its string value, and passes the result to exec() on the caller's host. The processor runs on every request made through the client, silent mode is on by default (the field is stripped from the returned object so callers never see the injected payload), and the package disables its logger at import time so exec errors are suppressed. A second path, addprocessor(trigger, code) and setdefault_processor(code), stores raw Python source strings that DataProcessor.process later exec()s when a matching endpoint returns, with errors swallowed by a bare except. Any HTTP server the client talks to — including a compromised upstream or an on-path attacker able to inject a 'cos' field into any JSON response — obtains arbitrary code execution on the host using the library.

Source: kam193 (eee14db4ceeeedc62311a8926bc641b77f2cce3345e5f9b6083663f8931cb92b)

The package contains a hidden backdoor. The promised functionality is an HTTP request library with some additional functions. On every usage, code secretly checks for the presence of specific fields in the response, and if they are found, their content is secretly executed.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-reqcrypt

Reasons (based on the campaign):

  • backdoor
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-21T11:11:08.495489406Z",
            "sha256": "eee14db4ceeeedc62311a8926bc641b77f2cce3345e5f9b6083663f8931cb92b",
            "modified_time": "2026-08-21T10:33:24.919997Z",
            "source": "kam193",
            "id": "pypi/2026-08-reqcrypt/requests-crypt",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "import_time": "2026-08-21T14:47:43.673526001Z",
            "sha256": "f971c743a8c6661c9078bdb6486843bb50831fadf9a9a6943e8231fac374ac2f",
            "modified_time": "2026-08-21T14:25:06Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018506",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / requests-crypt

Package

Name
requests-crypt
View open source insights on deps.dev
Purl
pkg:pypi/requests-crypt

Affected ranges

Affected versions

0.*
0.1.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/requests-crypt/MAL-2026-14351.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "baa457f33f565e11fb89ccc70501b6f062d1c7c4696396131bd4f5790903ad99",
            "path": "requests_crypt/__init__.py",
            "tlsh": "1712e959794bb101c3dbc0b5a85aea236b2f7c03538c7534b8fca59c1f15224d8f2ea9"
        }
    ],
    "package_integrity": [
        {
            "filename": "requests_crypt-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "19f131f7dacf42024983dc54a1578ebd2b156898134c54403eb0940e14493edc",
                "sha256": "183f75391d6dbde006132b5119361002e959b483cedeab5ff9ed68ee21952f16",
                "md5": "c94e17a963a42d04e56e3eff100bd56b"
            }
        },
        {
            "filename": "requests_crypt-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "fc237c397a78c7b4f67f667bcf62481f06b9e286d76efa0b13aefc30b0a317e3",
                "sha256": "8a7d940ee09c831dd9ef490347f7803667d56a5b8297dbd8294c5c9d8216870f",
                "md5": "f3171c143a89c88e4a7146f6a5b85997"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]