Malicious Code Detected in callapirequests Package - Remote Executable Download Vulnerability
Summary
MAL-2026-649: Malicious code in callapirequests (PyPI). Affects callapirequests versions 8.1.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The callapirequests package, available on PyPI, is designed to facilitate API requests in Python applications. It is intended to simplify the process of making HTTP requests to various web services. However, this package has been compromised, leading to the introduction of malicious code that poses significant security risks to users.
Vulnerability Detail
The vulnerability originates from a malicious actor identified as kam193, who has embedded code within the callapirequests package that downloads and executes a remote executable identified as malware. This malicious behavior can lead to severe consequences, including unauthorized access to sensitive information, system compromise, and potential data loss. The specific version affected is 8.1.9, which has been confirmed to contain this malicious code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall callapirequestsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the callapirequests package until a secure version is released. Alternatively, consider using other well-established libraries for making API requests, such as 'requests' or 'httpx', which do not exhibit this vulnerability.
Conclusion
The callapirequests package has been compromised with malicious code that downloads and executes malware, posing significant risks to users. It is essential to update the package to a secure version or consider alternative libraries to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for callapirequests →
FAQ
callapirequests is a Python package designed to simplify making API requests to web services.
The vulnerability was identified by security researchers who analyzed the package and found malicious code that downloads and executes malware.
The risks include unauthorized access to sensitive data, potential system compromise, and the execution of harmful software on the user's machine.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring signup.
If an immediate update is not possible, consider using alternative libraries for API requests and monitor for updates to the callapirequests package.
