MAL-2026-17181

Dashboard / Malicious Package / MAL-2026-17181

MAL-2026-17181

Summary: Malicious code in reqparser (PyPI)

Details: Source: amazon-inspector (4b829053417a14305f80204983289f120f71abd2472785cd4e2adfe095599003) The package name 'reqparser' resembles common HTTP client / parsing library names in the Python ecosystem, a shape frequently used by typosquat lures. The tarball contains 3 files, and no concrete installer-harm behavior (credential read, environment scraping, network exfiltration, install-time fetch-and-execute, lifecycle-script exec) could be corroborated in this record. Automated deep tracing did not produce reviewable output for this artifact. Source: kam193 (982923c14e644e82a839621d37715fd123568fc378aed45b6afa6247bc0b5054) During the module import, the package starts an infostealer. It exfiltrates data from crypto currency wallets and web browsers, ensures persistence and installs further malware. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-reqparser Reasons (based on the campaign): - malware - persistence - exfiltration-crypto - exfiltration-browser-data - The package contains code to detect if it is running in a sandbox environment. - infostealer - keylogger

References: https://bad-packages.kam193.eu/pypi/package/reqparser, https://pypi.org/project/reqparser/1.0.1/