MAL-2026-15859

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/0requests/MAL-2026-15859.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15859
Published
2026-09-03T17:00:47Z
Modified
2026-09-04T01:00:05.967093326Z
Summary
Malicious code in 0requests (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ce3a594da2523b6481bd4639f5d3aaed9ec11a9adf92c2b99bf99d0ab6fb5b78)

The package name '0requests' is a one-character variant of the popular PyPI package 'requests'. On import of the top-level package, init.py enumerates os.environ and collects every variable whose name begins with SECRET, API, TOKEN, or KEY, then opens a TCP socket to a host/port taken from the TSHOST and TSPORT environment variables and sends the serialized dictionary of credential-shaped variables. The same import path spawns a python subprocess that connects to the same TSHOST:TSPORT, sends a 'SHELL' marker, and sleeps to keep the socket open, providing a remote-controlled shell channel on the host. Console output includes '0requests installed -- targeting requests' and a '[typosquat] exfiltrating' log line, confirming intent.

Source: kam193 (b42d4eed37375dfa065db35c2e08365b9557b442c935e645b3e82564c4c32d7c)

During import, the code exfiltrates potentially sensitive env variables. In all analyzed versions the exfiltration target was a localhost, suggesting it was just a test.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2026-09-0requests

Reasons (based on the campaign):

  • exfiltration-env-variables

  • typosquatting

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-03T17:16:47.034563165Z",
            "source": "kam193",
            "versions": [
                "0.0.1"
            ],
            "id": "pypi/2026-09-0requests/0requests",
            "modified_time": "2026-09-03T17:00:54.97312Z",
            "sha256": "b42d4eed37375dfa065db35c2e08365b9557b442c935e645b3e82564c4c32d7c"
        },
        {
            "import_time": "2026-09-04T00:45:54.241287284Z",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ],
            "id": "IN-MAL-2026-019377",
            "modified_time": "2026-09-03T23:48:53Z",
            "sha256": "ce3a594da2523b6481bd4639f5d3aaed9ec11a9adf92c2b99bf99d0ab6fb5b78"
        }
    ]
}
References
Credits

Affected packages

PyPI / 0requests

Package

Name
0requests
View open source insights on deps.dev
Purl
pkg:pypi/0requests

Affected ranges

Affected versions

0.*
0.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/0requests/MAL-2026-15859.json"
indicators 
{
    "evidence_files": [
        {
            "path": "py_0requests/__init__.py",
            "tlsh": "00111ee2e859092d307a67428527503da3b3d2415b35680277b85e32af37ba8307a6b8",
            "sha256": "b2a6588476f40845a2df173d57d436dc47c0dfd044bcffdc936be1b509cffd3d"
        },
        {
            "path": "py_0requests/cli.py",
            "tlsh": "5ca022aa0fcc2838a820800eac2203288000e03220b33232eace028e0c8220080e0020",
            "sha256": "ca9c23bd931ee4ba9804838f52ec6dedae64eecb2b6c09fbafa0a7458cefc64e"
        }
    ],
    "package_integrity": [
        {
            "filename": "0requests-0.0.1-py3-none-any.whl",
            "hashes": {
                "md5": "c9a0424470c5d49ed5173303f41b874e",
                "blake2b_256": "999435e95433d9f364b7f60d82ea1c5667f2848bd6ea5ae6f41cb7505bf97501",
                "sha256": "c8784cf0aa8fa13a43614fbd6d51902feeecafdc06fc4db2695fd2572db66db8"
            }
        },
        {
            "filename": "0requests-0.0.1.tar.gz",
            "hashes": {
                "md5": "6f4a67ec1ae03325b1427a5c33aef095",
                "blake2b_256": "6bf24b256c7ec44f2e2a3320c955be9a0b0933bf79546f8d791db31a693cd9bb",
                "sha256": "99aed88269a370198174a549985d8ae7ccc0690aab5185685b960b77914ba31f"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]