Malicious Code Detected in requests-lite Package - Remote Command Execution Vulnerability
Summary
MAL-2026-1291: Malicious code in requests-lite (PyPI). Affects requests-lite versions 2.32.3 – 2.32.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The requests-lite package is a lightweight HTTP library for Python, designed to simplify making HTTP requests. It is a clone of the legitimate requests library, which is widely used for its ease of use and functionality. However, this particular version has been compromised, containing hidden malicious code that activates when the library's functionality is invoked, posing significant security risks to users.
Vulnerability Detail
The vulnerability originates from a malicious clone of the requests library, introduced by a user identified as kam193. The hidden code executes a Telegram bot that listens for remote commands, allowing an attacker to control the victim's machine. This vulnerability is categorized as malicious due to its intent to execute remote commands and potentially steal sensitive information. The affected versions include 2.32.3, 2.32.4, 2.32.5, and 2.32.7, which all contain this malicious functionality.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall requests-liteIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can uninstall the requests-lite package by running the command: pip uninstall requests-lite. Consider using the legitimate requests package instead, which does not contain any malicious code.
Conclusion
The requests-lite package has been compromised with malicious code that allows remote command execution. Users are urged to uninstall the affected versions and switch to the legitimate requests library to ensure their systems remain secure. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for requests-lite →
FAQ
The malicious code activates a Telegram bot that listens for remote commands, allowing unauthorized access to the victim's machine.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you have installed requests-lite, it is crucial to uninstall it immediately and replace it with the legitimate requests package.
Yes, the affected versions include 2.32.3, 2.32.4, 2.32.5, and 2.32.7.
Using the compromised package can lead to unauthorized remote access, data theft, and potential control over your machine by attackers.
