MAL-2026-1004 Malicious code in request-httpx-9 (PyPI)
- Package
- request-httpx-9
- Registry
- PyPI
What is MAL-2026-1004?
MAL-2026-1004 is a malicious package in request-httpx-9, published on 24 Feb 2026.
Official description
The package contains a Telegram bot running allowing for remote access. This functionality is disclosed in the readme, but the package name clearly indicates it's either a dependency confusion attempt or it's intended to be hidden from the user in the installed environment.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-02-request-httpx-4
Reasons (based on the campaign):
dependency-confusion
The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
files-exfiltration
What should I do about MAL-2026-1004?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.