MAL-2026-16274
Malicious code in requests-auroras (PyPI)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: kam193 (afa39517de816c01400eef99ef6ebce1357910c217c5e0ff55e4a252ea15a4c5) During installation, package starts a reverse shell.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-requests-triwes
Reasons (based on the campaign):
- The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine.
- The package overrides the install command in setup.py to execute malicious code during installation.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for requests-auroras (pip). Pin to a known-safe version or switch to an alternative.