Malicious code in 0requests (PyPI)

The '0requests' package is a malicious typosquatting package targeting users who mistakenly install it instead of the legitimate 'requests' package. Its __init__.py script enumerates environment variables starting with SECRET, API, TOKEN, or KEY, serializes them, and sends them via a TCP socket to a host and port defined by TS_HOST and TS_PORT environment variables. Additionally, it spawns a subprocess that connects to the same host and port, sends a 'SHELL' marker, and maintains an open socket to provide a remote-controlled shell. Console logs confirm its intent to exfiltrate data and provide remote access. The exfiltration target in analyzed versions was localhost, indicating possible testing rather than active malicious use.

If installed and imported, this package can leak sensitive environment variables containing credentials to an attacker-controlled host and provide a remote shell on the host system. This can lead to credential theft and unauthorized remote code execution. However, the known analyzed versions targeted localhost, which limits the immediate risk but does not eliminate the potential for harm if configured differently.

Users should avoid installing packages with names similar to popular packages to prevent typosquatting attacks. Remove the '0requests' package if installed. Since no official patch or fix exists, rely on careful package name verification and use trusted package sources. Monitor environment variables and restrict sensitive data exposure in environment variables where possible.