{"id":"MAL-2026-6245","title":"Malicious code in request-cache-py (PyPI)","summary":"Malicious code in request-cache-py (PyPI)","severity":"none","vendor":"request-cache-py","product":"request-cache-py","ecosystem":"pip","affected":["request-cache-py"],"published":"2026-06-20","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-6245","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/request-cache-py"},{"url":"https://pypi.org/project/request-cache-py/1.1.0/"},{"url":"https://pypi.org/project/request-cache-py/1.0.0/"},{"url":"https://pypi.org/project/request-cache-py/1.0.7/"},{"url":"https://pypi.org/project/request-cache-py/1.0.8/"},{"url":"https://pypi.org/project/request-cache-py/1.0.3/"},{"url":"https://pypi.org/project/request-cache-py/1.0.4/"},{"url":"https://pypi.org/project/request-cache-py/1.0.6/"},{"url":"https://pypi.org/project/request-cache-py/1.0.1/"},{"url":"https://pypi.org/project/request-cache-py/1.0.2/"},{"url":"https://pypi.org/project/request-cache-py/1.0.5/"},{"url":"https://pypi.org/project/request-cache-py/1.0.9/"}],"tags":["osv","pip"],"ingestedAt":"2026-07-09T11:56:19.586Z","slug":"MAL-2026-6245","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (eafb96e46544cb1351d26caf52bff79055bc205a1f8454737b677fff8fbc6fea)\nrequest-cache-py impersonates the legitimate requests-cache HTTP caching library. On `import request_cache_py`, the package's `__init__.py` starts a background thread that harvests installer-side secrets and POSTs them to a hardcoded attacker Telegram bot.\n\nObserved behaviors:\n- Reads private keys and credentials from `~/.ssh/` (`id_rsa`, `id_ed25519`, `id_ecdsa`, `id_dsa`), `~/.aws/credentials`, `~/.aws/config`, `~/.gitconfig`, `~/.git-credentials`, `~/.npmrc`, `~/.pypirc`, `~/.dockercfg`, `~/.docker/config.json`, plus gcloud and vscode settings.\n- Copies Chrome/Edge/Safari `Login Data`, `Cookies`, and `History` SQLite databases to `/tmp` and extracts saved logins, cookies, and browsing history (`SELECT origin_url, username_value FROM logins`; `SELECT host_key, name, value, path FROM cookies`).\n- Iterates `os.environ` and exfiltrates any variable whose name contains `key`, `token`, `secret`, `password`, `api`, or `auth`.\n- Posts the collected data to `https://api.telegram.org/bot<redacted>/sendMessage` with a fixed `chat_id`. The bot token and chat id are base64-split across pieces and reassembled at runtime to evade scanners.\n- Includes sandbox-evasion: `_should_skip()` aborts when `CI`, `GITHUB_ACTIONS`, `TRAVIS`, `JENKINS_HOME`, `CIRCLECI`, `/.dockerenv`, or hypervisor markers are present, restricting execution to real developer workstations. A `~/.cache/.pyrc` marker suppresses repeat sends within 24 hours.\n\nThe combination — name impersonation of a popular library, import-time credential harvest from classic developer secret paths, browser database theft, env scraping, base64-obfuscated C2, sandbox evasion — is a deliberate supply-chain credential stealer targeting human developers.\n\n## Source: kam193 (d027c4b6379310432f96b48dc78c73ddf1346052c5ab16ea6ed4fe3fc0754d08)\nDuring import, package exfiltrates browsers data, SSH keys and other credential files, env variables and other sensitive data.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-request-cache-py\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - exfiltration-env-variables\n\n\n - exfiltration-ssh-keys\n\n\n - impersonation\n\n\n - A Telegram webhook is used to send collected data.\n\n\n - exfiltration-browser-data\n\n\n - The package contains code to detect if it is running in a sandbox environment.\n\n\n - exfiltration-credentials\n\n\n - The malicious code is intentionally included in a dependency of the package\n\n\n## Affected packages\n\n- `request-cache-py`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}