The malicious requests-toolbelt-plus PyPI package contains no legitimate functionality and instead executes malicious code during installation. It detects WSL environments by inspecting /proc/version and, if confirmed, opens a TCP connection to a hardcoded IP address on port 4444. It sends a JSON beacon with user and system information, then spawns a background thread to receive and execute arbitrary shell commands remotely, returning output to the attacker. Additionally, it appends a Python one-liner to the user's ~/.bashrc to re-establish a reverse shell on every new login shell, providing persistent interactive shell access. This WSL-specific gating is designed to evade detection on non-targeted systems and focus on Windows Subsystem for Linux developer hosts.

Successful installation or import of this package on a WSL environment results in full remote command execution on the victim machine and persistent backdoor access via a reverse shell triggered on every new login shell. This compromises confidentiality, integrity, and availability of the affected system. The attacker gains persistent interactive shell access with the privileges of the installing user.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing requests-toolbelt-plus and verify package authenticity before installation. Remove any installed instances of requests-toolbelt-plus and inspect and clean the ~/.bashrc file to remove the malicious reverse shell code. Monitor for suspicious network connections to the hardcoded IP 185.184.192.205 on port 4444. Use trusted package sources and verify package signatures when possible.