reguestsc

GHSA-fg2c-58m3-mg4m

Malicious code in reguestsc (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 2.34.2`

## Source: kam193 (20e4ae2ce79408a65e9b4bb348c2d69e20eb6072e3641531e2ec5773f1bbddd6)
Clones of a legitimate library with injected code downloading and executing a malicious executable on import. Dynamic analysis identified it as salatstealer.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-07-reguestsc


Reasons (based on the campaign):


 - typosquatting


 - Downloads and executes a remote executable.


 - malware


 - clones-real-package


 - spyware-like


 - infostealer

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c4408eb5d73d7f6ea5b326edfc1eb83ca57b4b96/osv/malicious/pypi/reguestsc/MAL-2026-11413.json))

**References:**
- https://app.any.run/tasks/348751a8-657c-4a3d-bee1-dedae5264036
- https://bad-packages.kam193.eu/pypi/package/reguestsc
- https://github.com/ossf/malicious-packages/blob/c4408eb5d73d7f6ea5b326edfc1eb83ca57b4b96/osv/malicious/pypi/reguestsc/MAL-2026-11413.json
- https://tria.ge/260731-kqvw2aff97/behavioral1
- https://www.virustotal.com/gui/file/db86ed61afec83acb523e8b00558ee7641b2ddc388d542dc0ff2922625da013f/detection
- https://github.com/advisories/GHSA-fg2c-58m3-mg4m

Compromised versions (1)

= 2.34.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.