reqcrypts is a PyPI package advertised as a drop-in HTTP client. Its RequestHandler wraps JSON responses and base64-decodes a _payload field, executing its content via Python's exec() function and then deleting the field to conceal execution. This means any HTTP server responding with a JSON containing a _payload key can execute arbitrary Python code on the client host. The package also provides functions to register triggers and default payloads that execute arbitrary code silently when matched, creating a second covert code execution vector. This design is a deliberate backdoor enabling remote code execution from any responding server.

Any application using reqcrypts as its HTTP client is vulnerable to remote code execution by any HTTP server it contacts, including malicious servers, man-in-the-middle attackers, or redirect targets. This can lead to full compromise of the host environment running the Python interpreter. The malicious payload execution is silent and automatic, increasing the risk of unnoticed exploitation.

No official patch or remediation is currently available. Users should immediately cease using the reqcrypts package and remove it from their environments. Avoid installing or running code that depends on reqcrypts. Monitor dependency lists and supply chain sources to prevent accidental inclusion. Check vendor advisories or PyPI for updates or removal notices.