MAL-2026-649

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/callapirequests/MAL-2026-649.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-649

Published

2026-02-02T09:08:10Z

Modified

2026-02-02T10:02:54Z

Summary

Malicious code in callapirequests (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (6e7fadeb48347b57805dea2f58d0f662e43170e0e4439a424f6dec66cf285452)

Importing the module downloads and starts remote executable identified as malware

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2025-12-foxloveyou

Reasons (based on the campaign):

malware
Downloads and executes a remote executable.

Database specific

{
    "iocs":  {
        "domains":  [
            "3zoz.duckdns.org"
        ],
        "urls":  [
            "http://3zoz.duckdns.org:1111/1234",
            "http://3zoz.duckdns.org/config"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2025-12-foxloveyou/callapirequests",
            "import_time":  "2026-02-02T09:49:03.316491681Z",
            "modified_time":  "2026-02-02T09:08:10.922819Z",
            "sha256":  "6e7fadeb48347b57805dea2f58d0f662e43170e0e4439a424f6dec66cf285452",
            "source":  "kam193",
            "versions":  [
                "8.1.9"
            ]
        }
    ]
}

References

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / callapirequests

Package

Name: callapirequests; View open source insights on deps.dev
Purl: pkg:pypi/callapirequests

Affected ranges

Affected versions

8.*

8.1.9

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/callapirequests/MAL-2026-649.json"