Malicious Code Injection in fastapi-requests Package
Summary
MAL-2026-1261: Malicious code in fastapi-requests (PyPI). Affects fastapi-requests versions 0.0.0 – 2.32.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fastapi-requests package is a Python library designed to simplify HTTP requests in FastAPI applications. It aims to provide developers with an easy-to-use interface for making requests while leveraging the FastAPI framework's capabilities. However, this package has been found to contain malicious code that can execute remote scripts, posing a significant security risk to users.
Vulnerability Detail
The vulnerability originates from a malicious actor who cloned the legitimate fastapi-requests library and embedded hidden code that downloads and executes remote scripts. This type of attack is known as typosquatting, where a malicious package mimics a legitimate one to deceive users. The malicious code was designed to execute without the user's knowledge, potentially leading to data breaches or unauthorized access to sensitive information. The specific malicious domain identified during the analysis was cleverstack-ext30341.vercel.app, which was used to host the remote script.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall fastapi-requestsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the fastapi-requests package until they confirm the legitimacy of the package source. Additionally, consider using alternative libraries that provide similar functionality without the associated risks.
Conclusion
The fastapi-requests package has been compromised with malicious code that poses a serious security threat. Users are urged to take immediate action to remove the affected package and ensure they are using legitimate versions. Awareness and proactive monitoring are essential to safeguard applications against such vulnerabilities.
See every vulnerability recorded for fastapi-requests →
FAQ
fastapi-requests is a Python library that simplifies making HTTP requests within FastAPI applications.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If you have the fastapi-requests package installed, uninstall it immediately and replace it with a legitimate version from a trusted source.
Using a malicious package can lead to data breaches, unauthorized access to sensitive information, and potential compromise of your application and its users.
To prevent similar vulnerabilities, always verify the source of packages before installation, use trusted repositories, and regularly monitor your dependencies for known vulnerabilities.
