mal-2026-14351
Vulnerability from ossf_malicious_packages
Published
2026-08-21 10:33
Modified
2026-08-21 14:49
Summary
Malicious code in requests-crypt (PyPI)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (f971c743a8c6661c9078bdb6486843bb50831fadf9a9a6943e8231fac374ac2f)
requests-crypt wraps an HTTP client so that every JSON response passes through a DataProcessor that reads a configurable field (default 'cos') from the response body, base64-decodes its string value, and passes the result to exec() on the caller's host. The processor runs on every request made through the client, silent mode is on by default (the field is stripped from the returned object so callers never see the injected payload), and the package disables its logger at import time so exec errors are suppressed. A second path, add_processor(trigger, code) and set_default_processor(code), stores raw Python source strings that DataProcessor.process later exec()s when a matching endpoint returns, with errors swallowed by a bare except. Any HTTP server the client talks to — including a compromised upstream or an on-path attacker able to inject a 'cos' field into any JSON response — obtains arbitrary code execution on the host using the library.
Source: kam193 (eee14db4ceeeedc62311a8926bc641b77f2cce3345e5f9b6083663f8931cb92b)
The package contains a hidden backdoor. The promised functionality is an HTTP request library with some additional functions. On every usage, code secretly checks for the presence of specific fields in the response, and if they are found, their content is secretly executed.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-08-reqcrypt
Reasons (based on the campaign):
- backdoor
CWE
- CWE-506 - The product contains code that appears to be malicious in nature.
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "requests_crypt/__init__.py",
"sha256": "baa457f33f565e11fb89ccc70501b6f062d1c7c4696396131bd4f5790903ad99",
"tlsh": "1712e959794bb101c3dbc0b5a85aea236b2f7c03538c7534b8fca59c1f15224d8f2ea9"
}
],
"package_integrity": [
{
"filename": "requests_crypt-0.1.0-py3-none-any.whl",
"hashes": {
"blake2b_256": "19f131f7dacf42024983dc54a1578ebd2b156898134c54403eb0940e14493edc",
"md5": "c94e17a963a42d04e56e3eff100bd56b",
"sha256": "183f75391d6dbde006132b5119361002e959b483cedeab5ff9ed68ee21952f16"
}
},
{
"filename": "requests_crypt-0.1.0.tar.gz",
"hashes": {
"blake2b_256": "fc237c397a78c7b4f67f667bcf62481f06b9e286d76efa0b13aefc30b0a317e3",
"md5": "f3171c143a89c88e4a7146f6a5b85997",
"sha256": "8a7d940ee09c831dd9ef490347f7803667d56a5b8297dbd8294c5c9d8216870f"
}
}
]
}
},
"package": {
"ecosystem": "PyPI",
"name": "requests-crypt"
},
"versions": [
"0.1.0"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
},
{
"contact": [
"https://github.com/kam193",
"https://bad-packages.kam193.eu/"
],
"name": "Kamil Ma\u0144kowski (kam193)",
"type": "REPORTER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "pypi/2026-08-reqcrypt/requests-crypt",
"import_time": "2026-08-21T11:11:08.495489406Z",
"modified_time": "2026-08-21T10:33:24.919997Z",
"sha256": "eee14db4ceeeedc62311a8926bc641b77f2cce3345e5f9b6083663f8931cb92b",
"source": "kam193",
"versions": [
"0.1.0"
]
},
{
"id": "IN-MAL-2026-018506",
"import_time": "2026-08-21T14:47:43.673526001Z",
"modified_time": "2026-08-21T14:25:06Z",
"sha256": "f971c743a8c6661c9078bdb6486843bb50831fadf9a9a6943e8231fac374ac2f",
"source": "amazon-inspector",
"versions": [
"0.1.0"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f971c743a8c6661c9078bdb6486843bb50831fadf9a9a6943e8231fac374ac2f)\nrequests-crypt wraps an HTTP client so that every JSON response passes through a DataProcessor that reads a configurable field (default \u0027cos\u0027) from the response body, base64-decodes its string value, and passes the result to exec() on the caller\u0027s host. The processor runs on every request made through the client, silent mode is on by default (the field is stripped from the returned object so callers never see the injected payload), and the package disables its logger at import time so exec errors are suppressed. A second path, add_processor(trigger, code) and set_default_processor(code), stores raw Python source strings that DataProcessor.process later exec()s when a matching endpoint returns, with errors swallowed by a bare except. Any HTTP server the client talks to \u2014 including a compromised upstream or an on-path attacker able to inject a \u0027cos\u0027 field into any JSON response \u2014 obtains arbitrary code execution on the host using the library.\n\n## Source: kam193 (eee14db4ceeeedc62311a8926bc641b77f2cce3345e5f9b6083663f8931cb92b)\nThe package contains a hidden backdoor. The promised functionality is an HTTP request library with some additional functions. On every usage, code secretly checks for the presence of specific fields in the response, and if they are found, their content is secretly executed.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-08-reqcrypt\n\n\nReasons (based on the campaign):\n\n\n - backdoor\n",
"id": "MAL-2026-14351",
"modified": "2026-08-21T14:49:38.696901704Z",
"published": "2026-08-21T10:33:24Z",
"references": [
{
"type": "WEB",
"url": "https://bad-packages.kam193.eu/pypi/package/requests-crypt"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/requests-crypt/0.1.0/"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in requests-crypt (PyPI)"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…