sf-th-requests (PyPI) · Malicious Code
Affects sf-th-requestsSource GCVE Database
Malicious package : remove sf-th-requests and rotate any secrets on hosts that installed it.
Data as of 27 Oct 2026, 01:03 UTC
Malicious package
Published to PyPI · OSV MAL-2026-3135
What to do
Remove sf-th-requests from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIsf-th-requests | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The sf-th-requests package on PyPI contains malicious code that exfiltrates environment variables and cloud credentials/tokens to a hardcoded location during import. This behavior indicates clear intent to steal sensitive information from affected systems. The malicious versions identified are 0.1.0 and 0.2.0.