Malicious code in py-1requests (PyPI)

py-1requests is a typosquatting package on PyPI designed to mimic the legitimate requests library but contains malicious code. Its __init__.py script iterates over environment variables to collect sensitive data (variables starting with SECRET, API, TOKEN, or KEY) and sends this data serialized over a TCP socket to a host and port defined by environment variables or defaulting to 127.0.0.1:9999. Additionally, it spawns a subprocess that connects to the same host and port, sending a 'SHELL' marker to hold the connection open, effectively creating a reverse-shell staging path. These behaviors trigger immediately upon import without user interaction. The package prints messages admitting its typosquatting and exfiltration purpose. Analysis indicates the exfiltration target is localhost, implying this is likely a pentest or research tool with low harm potential rather than an active widespread threat.

If imported in an environment containing sensitive environment variables, py-1requests would exfiltrate those variables to a TCP endpoint, potentially exposing secrets such as API keys or tokens. The reverse-shell staging connection could allow remote command execution if the attacker controls the listening endpoint. However, the default exfiltration target is localhost, limiting the impact unless the environment variables TS_HOST and TS_PORT are set to external hosts. There are no known exploits in the wild and the package appears to be designed for pentesting or research purposes.

Avoid installing or importing the py-1requests package. Remove it if found in your environment. Since this is a malicious typosquat package, ensure package names are carefully verified before installation. No official patch or fix exists because this is a malicious package rather than a vulnerability in legitimate software. Monitor for and block connections to unexpected localhost ports if suspicious. No further action is required if the package is not present.