Malicious Code Detected in reqpack: A Threat to PyPI Users
Summary
MAL-2026-2116: Malicious code in reqpack (PyPI). Affects reqpack versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
reqpack is a package available on the Python Package Index (PyPI) that is often used as a dependency in various Python projects. It is designed to facilitate the management of request packages. However, recent findings have revealed that reqpack has been compromised and is now associated with malicious activities, specifically in the context of a broader campaign targeting users through dependency manipulation.
Vulnerability Detail
The vulnerability in reqpack stems from its association with malicious code that is designed to exfiltrate sensitive information from users' systems, such as IP addresses and usernames. This code is not inherently malicious on its own but becomes dangerous when combined with other dependencies in the campaign. The malicious actions include data exfiltration through DNS and tracking user activities by installing additional packages from private repositories. The origin of this vulnerability is linked to a campaign identified as '2026-03-geekennedy', which utilizes reqpack as a vehicle for its malicious intent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall reqpackIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using reqpack and its dependencies until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the reqpack package poses a significant threat to users relying on this dependency. It is essential to take immediate action by updating the package and considering alternative solutions to safeguard against potential data breaches. Continuous monitoring of dependencies is crucial for maintaining security.
See every vulnerability recorded for reqpack →
FAQ
reqpack is a Python package used for managing request packages, but it has recently been found to contain malicious code.
The malicious code in reqpack can exfiltrate sensitive information from the user's system and install additional malicious packages.
You should update reqpack to the latest version using 'pip install --upgrade reqpack' to mitigate the risk.
Yes, consider using other packages that offer similar functionalities without the associated security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
References
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.