Malicious Code Detected in fastapis-requests Package: Remote Script Execution Vulnerability
Summary
MAL-2026-1262: Malicious code in fastapis-requests (PyPI). Affects fastapis-requests versions 2.32.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fastapis-requests package is a Python library available on PyPI that is intended to facilitate HTTP requests in FastAPI applications. It is designed to be a user-friendly wrapper around standard request functionalities, allowing developers to easily integrate API calls into their applications. However, this package has been found to clone a legitimate library while embedding malicious code that can execute remote scripts, posing a significant security risk to users.
Vulnerability Detail
The vulnerability originates from the fastapis-requests package, which contains hidden malicious code that downloads and executes a remote script from an external server. This behavior indicates a clear malicious intent, as it can lead to unauthorized access to sensitive information, data theft, or further exploitation of the affected systems. The malicious code was identified during an analysis, but the remote script it attempted to execute was no longer available at the time of the investigation. The package also exhibits characteristics of typosquatting, where it mimics a legitimate package to deceive users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall fastapis-requestsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should avoid using the fastapis-requests package altogether and consider using well-known and trusted libraries such as 'requests' or 'httpx' for making HTTP requests in their FastAPI applications. Example code for using the 'requests' library is as follows:
import requests
response = requests.get('https://api.example.com/data')
print(response.json())
Conclusion
The fastapis-requests package has been identified as containing malicious code that poses a serious security risk. Users are strongly advised to uninstall this package and switch to trusted alternatives to protect their applications from potential exploitation. Monitoring tools like Vulert can help ensure ongoing security against such vulnerabilities.
See every vulnerability recorded for fastapis-requests →
FAQ
fastapis-requests is a Python library designed to simplify making HTTP requests in FastAPI applications.
The vulnerability allows malicious code to be executed remotely, which can lead to data theft or unauthorized access to your application.
You should uninstall the fastapis-requests package immediately and consider using a trusted alternative.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing your Pipfile.lock.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
