MAL-2026-6247

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/requests-enhancer/MAL-2026-6247.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-6247

Published

2026-06-20T23:24:02Z

Modified

2026-06-20T23:45:58.223951509Z

Summary

Malicious code in requests-enhancer (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (950c9d9155d6ba10a8d63c365fc6c7cc97d8bc6210165f93282d9e198ed3dd62)

Malicious package with a chain of multiple manual dependencies to finally download malicious code. During import, it manually downloads a dependency from GitHub repository "Hexa-devy/netflow-utils", which then attempts to download "codexio-boop/platform_syslib". The last one contains obfuscated code that during installation connects with node22.lunes[.]host:3258 and downloads encrypted payload. The payload is executed, and it then starts another loop of connections to node22.lunes[.]host:22240 and awaits next payloads to execute. During analysis, this stage did not deliver any payload. On every stage, short-living generated tokens are used.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-requests-enhancer

Reasons (based on the campaign):

backdoor
The package overrides the install command in setup.py to execute malicious code during installation.
obfuscation
The malicious code is intentionally included in a dependency of the package
The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

Database specific

{
    "malicious-packages-origins": [
        {
            "sha256": "950c9d9155d6ba10a8d63c365fc6c7cc97d8bc6210165f93282d9e198ed3dd62",
            "source": "kam193",
            "modified_time": "2026-06-20T23:24:02.247136Z",
            "versions": [
                "1.4.2"
            ],
            "id": "pypi/2026-06-requests-enhancer/requests-enhancer",
            "import_time": "2026-06-20T23:31:19.136908039Z"
        }
    ],
    "iocs": {
        "urls": [
            "https://github.com/codexio-boop/platform_syslib/archive/refs/heads/master.zip",
            "https://github.com/Hexa-devy/netflow-utils/archive/refs/heads/master.zip",
            "http://node22.lunes.host:3258/sync?v=",
            "http://node22.lunes.host:3258/go?n=",
            "http://node22.lunes.host:22240/update?v="
        ]
    }
}

References

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / requests-enhancer

Package

Name: requests-enhancer; View open source insights on deps.dev
Purl: pkg:pypi/requests-enhancer

Affected ranges

Affected versions

1.*

1.4.2

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/requests-enhancer/MAL-2026-6247.json"