httpz-requests is a malicious PyPI package that exposes a Telegram bot allowing remote operators to execute arbitrary shell commands on the host system under the installer's user account. The bot supports commands for executing shell scripts, deleting files, exfiltrating single or multiple files, creating full-host backups in split archives, and dumping environment variables. The package is shipped as obfuscated compiled Cython .so files, with command strings XOR+base64 encoded and disguised as HTTP requests to evade detection in process listings and logs. The Telegram bot token is stored encoded and decoded at runtime. The package name and import name closely resemble the popular requests package to deceive users. It automatically ensures persistence and starts malicious processes upon import, facilitating remote access and data theft.

This malicious package grants remote attackers full command execution on the host machine under the installing user's privileges. It enables theft of filesystem contents, environment variables, and sensitive credentials, potentially compromising cloud and CI environments. The persistence mechanism allows continued unauthorized access. The obfuscation and disguise techniques hinder detection and forensic analysis. Overall, it poses a severe risk of data exfiltration, system compromise, and credential theft.

This package is inherently malicious and should be removed immediately if found in any environment. Users should avoid installing packages with suspicious or misleading names, especially those resembling popular libraries. There is no official patch or fix since this is a malicious package rather than a vulnerability in legitimate software. Security teams should audit installed packages, verify package provenance, and consider blocking or monitoring PyPI packages with similar suspicious characteristics. Use trusted sources and verify package integrity before installation.