The py-2equests package on PyPI is a malicious typosquatting package impersonating the popular 'requests' library. When imported, it collects environment variables with keys starting with SECRET, API, TOKEN, or KEY and sends them to a configurable remote host and port. It also opens a reverse shell connection to the same destination, allowing remote code execution. The package version 0.0.1 is affected. The exfiltration target in analyzed versions was localhost, indicating possible testing rather than active widespread exploitation.