Malicious code in py-2equests (PyPI)

py-2equests is a malicious Python package designed to impersonate the legitimate 'requests' library by substituting '2' for 'r' in the name. Upon import, it scans environment variables for sensitive keys and exfiltrates their values over a TCP socket to a host and port specified by environment variables (defaulting to 127.0.0.1:9999). It then spawns a subprocess that establishes a reverse shell connection to the same host and port, enabling remote shell access. The package self-documents its intent with comments and CLI messages. The only known affected version is 0.0.1. The exfiltration target being localhost suggests the package may have been used for testing or pentesting purposes rather than active malicious campaigns.

Any process importing py-2equests version 0.0.1 will leak sensitive environment variables such as secrets, API keys, tokens, and credentials to a remote host controlled by an attacker. Additionally, it grants remote shell access to the attacker via a reverse shell, potentially allowing full control over the affected system. This poses a critical confidentiality and integrity risk to affected environments.

No official patch or remediation is available for py-2equests since it is a malicious typosquatting package rather than a legitimate library. The best mitigation is to avoid installing or importing py-2equests and to verify package names carefully before installation. Remove any instances of py-2equests from environments and scan for unauthorized packages. Monitor for unexpected network connections to suspicious hosts. Since the exfiltration target defaults to localhost, verify no internal services are compromised. There is no vendor advisory or official fix; patch status is not applicable.