Malicious code in py-0requests (PyPI)

py-0requests is a malicious PyPI package that uses homoglyph typosquatting to impersonate the legitimate 'requests' package. Its __init__.py code, executed on import, scrapes environment variables with sensitive prefixes and sends them over a TCP socket to a host and port specified by environment variables (defaulting to 127.0.0.1:9999). It also spawns a subprocess that opens a TCP connection to the same host/port, sends a 'SHELL' marker, and maintains the connection to provide a reverse shell to an operator. The package's CLI banner states it targets 'requests' but it contains no HTTP client API. Analysis indicates the exfiltration target is localhost, suggesting a low-harm or pentesting context. The only known affected version is 0.0.1.

If imported, this package can exfiltrate sensitive environment variables and establish a reverse shell, potentially allowing remote code execution by an attacker controlling the specified TCP endpoint. However, the default exfiltration target is localhost, indicating limited risk unless the attacker controls the local machine or the environment variables TS_HOST/TS_PORT are set to an external host. No known active exploitation in the wild has been reported.

Avoid installing or importing the py-0requests package. Use the legitimate 'requests' package from PyPI. Since no official patch or fix exists for py-0requests (it is a malicious package rather than a vulnerability in a legitimate package), remediation involves removing the package and auditing environments for its presence. No vendor advisory or patch is available. Monitor for and block typosquatting packages in supply chain processes.