MalwarePublished 7 Aug 2026

flasq (PyPI) · Malicious Code

Affects flasqSource GCVE Database

Malicious package : remove flasq and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:40 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-13487

What to do

Remove flasq from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIflasq	Affected 0.1.1 – 0.3.0 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The PyPI package 'flasq' is a malicious typosquatting artifact that impersonates the popular 'requests' library by using a similar name 'requestss'. During installation, it executes obfuscated code that downloads a binary from an unrelated GitHub account, saves it to /tmp, makes it executable, and runs it detached. This binary is reported to exfiltrate cryptocurrency wallet data and potentially other sensitive information. The malicious behavior is unrelated to the advertised functionality of HTTP client utilities. The affected versions are 0.1.1, 0.1.2, 0.2.0, and 0.3.0.

Impact

Installation of the affected 'flasq' package results in execution of a remote binary that can exfiltrate sensitive data, including cryptocurrency wallet information. This compromises the confidentiality of user data and potentially the security of affected systems. The malicious code runs with the privileges of the installing user and can operate undetected due to obfuscation and detached execution.

Defensive guidance

Users should avoid installing the 'flasq' package and verify package names carefully to avoid typosquatting traps. Monitor for any unexpected binaries in /tmp and network connections to suspicious domains such as the indicated GitHub repository.

Summary

The 'flasq' package on PyPI uses a typosquatting name 'requestss' to trick developers mistyping 'requests'. Its setup.py overrides the install command to run a base64-encoded post-install hook that downloads a remote executable from a personal GitHub repository without any integrity verification. This executable is saved to /tmp, permissioned to be executable, and launched detached. The malicious payload exfiltrates cryptocurrency wallet data and likely other sensitive information. The package's behavior is obfuscated and unrelated to its advertised purpose, indicating clear malicious intent.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:40 UTC

Technical details

References

Community reviews