MAL-2026-18743: Malicious code in reqnest (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (819e0998a4223acf5f70c15fbbeea8f9c9bf801044d5974622ebc2a971bc2c61) During import, package exfiltrates sensitive Telegram files to a remote location.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-reqnest
Reasons (based on the campaign):
- files-exfiltration
- target:telegram
- typosquatting
Affected Software
Event History
Frequently Asked Questions
What action triggers the malicious behavior?
The package exfiltrates data during import. Systems that installed but never imported reqnest are not identified by the available data as having triggered the described behavior.
What evidence can be used to investigate possible exposure?
The available data does not provide a remote endpoint, file paths, indicators of compromise, or other forensic artifacts. It identifies sensitive Telegram files as the targeted data and states that they are sent to a remote location.