The py-0requests package on PyPI is a malicious typosquatting package impersonating the popular 'requests' library by replacing the letter 'o' with the digit '0'. Upon import, it exfiltrates environment variables with keys starting with SECRET, API, TOKEN, or KEY to a TCP server, defaulting to localhost. It also establishes a reverse shell connection to the same destination, enabling remote control. The package does not provide any HTTP client functionality and appears designed for testing or pentesting purposes, as the exfiltration target is localhost. Only version 0.0.1 is known to be affected.