reqcrypt is a Python HTTP client library that unconditionally inspects every HTTP response for JSON keys named 'payloaddd', 'payload_gz', and 'payload_zlib'. It base64/gzip/zlib-decodes the associated values and executes the resulting code via exec() in the caller's process. This hidden backdoor is triggered on every HTTP verb method (get/post/put/delete/patch/download/upload), enabling remote code execution from attacker-controlled or attacker-influenced HTTP responses. The malicious behavior is undocumented and embedded in the package, representing a severe security risk.

Any program using reqcrypt version 0.1.0 is vulnerable to remote code execution through attacker-controlled HTTP responses. This allows an attacker to execute arbitrary Python code within the context of the calling process, potentially leading to full system compromise or data theft.

No official patch or remediation is currently available. Users should immediately stop using reqcrypt version 0.1.0 and remove it from their environments. Avoid using this package until a trustworthy, clean version is released or an official advisory provides remediation guidance.