The py-1requests package is a malicious typosquat of the popular Python requests library. On import, it collects environment variables with names starting with SECRET, API, TOKEN, or KEY and exfiltrates them via a TCP connection to a configurable host and port, defaulting to localhost:9999. It also establishes a reverse-shell staging connection. These actions occur unconditionally upon import with no legitimate purpose. The exfiltration target being localhost suggests this may be a test or pentest tool rather than widespread malicious use.