MAL-2026-18744: Malicious code in reqnests (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (285a91689676a0169502a364e60033283150056487ad681648ab60cb4fe6d23e) During import, package exfiltrates sensitive Telegram files to a remote location.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-reqnest
Reasons (based on the campaign):
- files-exfiltration
- target:telegram
- typosquatting
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this package?
Users or environments that install and import the PyPI package named reqnests are exposed. The package is identified as a typosquatting campaign targeting Telegram-related files.
What action triggers the malicious behavior?
The reported exfiltration occurs during package import. Importing reqnests can send sensitive Telegram files to a remote location.
How can I determine whether an environment may be affected?
Check dependency manifests, package installation records, and application source code for the reqnests package and for imports of it. Any environment where it was imported should be treated as potentially exposed because the behavior is triggered at import time.
What should be done if the package is present?
Remove reqnests from the environment and prevent it from being installed again. Because it may exfiltrate sensitive Telegram files, investigate systems where it was imported for potential exposure of those files.