Remote Command Execution Vulnerability in request-httpx-9 Package
Summary
MAL-2026-1004: Malicious code in request-httpx-9 (PyPI). Affects request-httpx-9 versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The request-httpx-9 package, available on PyPI, is designed for HTTP requests but has been compromised to include a Telegram bot that allows for remote access. This malicious functionality is not immediately apparent to users, as it is either a dependency confusion attempt or an attempt to obscure its true purpose. The package's presence in the ecosystem poses a significant risk to users who may unknowingly install it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the request-httpx-9 package. This code enables the execution of remote commands on the victim's machine, potentially leading to unauthorized access and control. The package is categorized as malicious due to its intent to exfiltrate files and execute commands without user consent. Users are at risk of data breaches and system compromise if they install this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall request-httpx-9If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid using the request-httpx-9 package altogether and look for alternative packages that provide similar functionality without the associated risks. Additionally, users can implement network security measures to monitor and restrict unauthorized access to their systems.
Conclusion
The request-httpx-9 package poses a significant security risk due to its malicious code that allows for remote command execution. Users are advised to uninstall the package immediately and consider alternatives. Regular monitoring of dependencies for vulnerabilities is crucial to maintaining software security.
See every vulnerability recorded for request-httpx-9 →
FAQ
request-httpx-9 is a Python package designed for making HTTP requests, but it has been compromised to include malicious functionality.
The vulnerability allows remote command execution, which can lead to unauthorized access and potential data breaches on your system.
You should uninstall the package immediately and monitor your system for any suspicious activity.
Yes, consider using other well-known and trusted HTTP request libraries such as 'requests' or 'httpx' that do not have known vulnerabilities.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software in real-time. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
