Which versions of reqests-2 are malicious?

The following PyPI versions of reqests-2 are flagged malicious: 2.32.3. Treat any of these as compromised.

How do I remediate reqests-2 if I installed it?

reqests-2 is a typosquat — you almost certainly intended a legitimately-named package. Remove reqests-2, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed reqests-2 — how do I know if it already compromised me?

If reqests-2 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is reqests-2 part of a known attack campaign?

Yes — reqests-2 is associated with the RLMA-2024-09124, GENERIC-typosquatting-clone-pentest, RLUA-2026-00696 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find reqests-2 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for reqests-2 (version 2.32.3).

Malicious package

reqests-2PyPI

Advisory published Aug 5, 2024Updated Mar 19, 2026

reqests-2 is a confirmed malicious PyPI package (MAL-2024-10154) that typosquats a legitimate package to trick installs (malicious version 2.32.3). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in reqests-2 (PyPI)

MAL-2024-10154

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall reqests-2

What this malware does

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-typosquatting-clone-pentest

Reasons (based on the campaign):

typosquatting

Malicious versions

1 flagged

2.32.3

Indicators of compromise (SHA-256)

7eaa4f447d575c0e8bf15cbede8c2fb4255edca32da3da5d89dd9d488d947fef

d169b8e4843cfa59e473c89e1d82f080c060d6bd93c4253e86626fac68700de4

439152aa004a93a52d0010d5727e26fd0f7c5bf3cb65695cb96a86c2335d57bf

d5c1d9d56de04a8bcd9510064045ed103e961d662cccff5aaede60fed8073cc7

866f8870c676fd286f260cac4028b7a66442cf431dd139fc19ef94393679718d

Detection & response playbook

Typosquat

Find it
Search your lockfiles and build artifacts for reqests-2 (version 2.32.3).
If you installed it — respond
reqests-2 is a typosquat — you almost certainly intended a legitimately-named package. Remove reqests-2, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If reqests-2 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. reqests-2 on PyPI has been identified as a malicious package (version 2.32.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-09124GENERIC-typosquatting-clone-pentestRLUA-2026-00696

References

bad-packages.kam193.eu

Credits

Kamil Mańkowski (kam193)
ReversingLabs · finder

Detect & block this

O3 blocks reqests-2-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database