httpz-requests

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (004770b4da0c6705f95ef2c8654fd81d37650ffacaad7160041bded02cdb7fbc)
httpz-requests exposes a Telegram bot (`start_bot`, `run_cmd_enc`, `http_request`) whose message handler executes arbitrary shell commands on the host running the package, granting a remote Telegram operator full command execution under the installer's user account. Documented remote commands include arbitrary shell execution (`chalao`, `.sh <command>`, `.py <file>`, `.exec <file>`), destructive filesystem operations (`rm -rf <path>`), single- and bulk-file exfiltration (`take <file>`, `take all`), a full-host backup mode that produces split 50MB archives with `.partNNN` chunking (`get all`), and environment-variable dumping (`.printenv`) — collectively enabling remote theft of filesystem contents and process-environment secrets (cloud, CI, and API credentials). The package is shipped only as compiled Cython `.so` files with no Python source, and self-describes obfuscation features that XOR+base64-encode command strings and disguise execution as `http_request("POST",...)` so plaintext commands do not appear in `ps` or system logs; the Telegram bot token is stored encoded and decoded at runtime by `dec()`. The distribution name `httpz-requests` and import name `httpz_requests` resemble the top-100 PyPI package `requests` while presenting a Telegram remote-shell API instead of an HTTP client, and metadata is unfilled boilerplate (author `Aapka Naam <[email protected]>`, homepage `https://github.com/YOUR_GITHUB_USERNAME/httpz-requests`).

## Source: kam193 (38eff923106836997e28de6d7173a1553da126be230b341fe64f0c4c215769a2)
The package provides Telegram-based remote access to the machine it runs on. It was deliberately created and used to hack other machines, exfiltrate files and credentials. This package automatically ensures persistence and starts a malicious process on import.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-08-httpz-requests


Reasons (based on the campaign):


 - files-exfiltration


 - rat


 - persistence


 - uses-telegram-bot


 - obfuscation


 - native-extension

Compromised versions (34)

• 1.8.0
• 1.9.0
• 1.10.0
• 1.11.0
• 1.12.0
• 1.13.0
• 1.14.0
• 1.15.0
• 1.16.0
• 1.17.0
• 1.18.0
• 1.19.0
• 1.20.0
• 1.21.0
• 1.21.1
• 1.21.2
• 1.21.3
• 1.21.4
• 1.21.5
• 1.21.6
• 1.21.7
• 1.21.8
• 1.21.9
• 1.21.10
• 1.21.11
• 1.21.12
• 1.21.13
• 1.21.14
• 1.21.15
• 1.21.16
• 1.21.17
• 1.21.18
• 1.21.19
• 1.21.20

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.