Malicious Code Detected in request-httpx-4 Package - Remote Access Vulnerability
Summary
MAL-2026-1001: Malicious code in request-httpx-4 (PyPI). Affects request-httpx-4 versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The request-httpx-4 package, available on PyPI, is designed for HTTP requests in Python applications. However, it has been compromised to include a Telegram bot that allows remote access to the user's machine. This malicious functionality is not immediately apparent, as it is obscured by the package name, which suggests a potential dependency confusion attempt.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the request-httpx-4 package. This code enables the execution of remote commands on the victim's machine, posing significant security risks such as unauthorized access and data exfiltration. The package's README discloses the bot's functionality, but the malicious intent is masked, making it a deceptive threat. Users may unknowingly install this package, exposing their systems to exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall request-httpx-4If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider using alternative packages that provide similar functionality without the associated risks. Additionally, you can monitor your dependencies for vulnerabilities using tools like Vulert, which can alert you to issues in real-time.
Conclusion
The request-httpx-4 package has been identified as containing malicious code that allows for remote access to users' machines. It is essential to uninstall this package and monitor your environment for any signs of compromise. Utilizing tools like Vulert can help maintain the security of your software dependencies.
See every vulnerability recorded for request-httpx-4 →
FAQ
request-httpx-4 is a Python package designed for making HTTP requests, but it has been compromised to include malicious code.
The malicious code allows remote access to your machine, enabling unauthorized command execution and potential data theft.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without needing to sign up.
Immediately uninstall the package using 'pip uninstall request-httpx-4' and monitor your system for any unusual activity.
Yes, Vulert provides a service that monitors your open-source dependencies for vulnerabilities in real-time.
