MAL-2026-14130

Dashboard / Malicious Package / MAL-2026-14130

MAL-2026-14130

Summary: Malicious code in httpz-requests (PyPI)

Details: Source: amazon-inspector (004770b4da0c6705f95ef2c8654fd81d37650ffacaad7160041bded02cdb7fbc) httpz-requests exposes a Telegram bot (`start_bot`, `run_cmd_enc`, `http_request`) whose message handler executes arbitrary shell commands on the host running the package, granting a remote Telegram operator full command execution under the installer's user account. Documented remote commands include arbitrary shell execution (`chalao`, `.sh <command>`, `.py <file>`, `.exec <file>`), destructive filesystem operations (`rm -rf <path>`), single- and bulk-file exfiltration (`take <file>`, `take all`), a full-host backup mode that produces split 50MB archives with `.partNNN` chunking (`get all`), and environment-variable dumping (`.printenv`) — collectively enabling remote theft of filesystem contents and process-environment secrets (cloud, CI, and API credentials). The package is shipped only as compiled Cython `.so` files with no Python source, and self-describes obfuscation features that XOR+base64-encode command strings and disguise execution as `http_request("POST",...)` so plaintext commands do not appear in `ps` or system logs; the Telegram bot token is stored encoded and decoded at runtime by `dec()`. The distribution name `httpz-requests` and import name `httpz_requests` resemble the top-100 PyPI package `requests` while presenting a Telegram remote-shell API instead of an HTTP client, and metadata is unfilled boilerplate (author `Aapka Naam <[email protected]>`, homepage `https://github.com/YOUR_GITHUB_USERNAME/httpz-requests`). Source: kam193 (38eff923106836997e28de6d7173a1553da126be230b341fe64f0c4c215769a2) The package provides Telegram-based remote access to the machine it runs on. It was deliberately created and used to hack other machines, exfiltrate files and credentials. This package automatically ensures persistence and starts a malicious process on import. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-httpz-requests Reasons (based on the campaign): - files-exfiltration - rat - persistence - uses-telegram-bot - obfuscation - native-extension

References: https://bad-packages.kam193.eu/pypi/package/httpz-requests, https://pypi.org/project/httpz-requests/1.14.0/, https://pypi.org/project/httpz-requests/1.16.0/, https://pypi.org/project/httpz-requests/1.11.0/, https://pypi.org/project/httpz-requests/1.21.0/, https://pypi.org/project/httpz-requests/1.21.2/, https://pypi.org/project/httpz-requests/1.21.4/, https://pypi.org/project/httpz-requests/1.13.0/, https://pypi.org/project/httpz-requests/1.19.0/, https://pypi.org/project/httpz-requests/1.21.5/, https://pypi.org/project/httpz-requests/1.21.1/, https://pypi.org/project/httpz-requests/1.10.0/, https://pypi.org/project/httpz-requests/1.21.3/, https://pypi.org/project/httpz-requests/1.15.0/, https://pypi.org/project/httpz-requests/1.18.0/, https://pypi.org/project/httpz-requests/1.12.0/, https://pypi.org/project/httpz-requests/1.17.0/, https://pypi.org/project/httpz-requests/1.8.0/, https://pypi.org/project/httpz-requests/1.20.0/, https://pypi.org/project/httpz-requests/1.9.0/