What does the request-cache-py malware do?

request-cache-py impersonates the legitimate requests-cache HTTP caching library. On `import request_cache_py`, the package's `__init__.py` starts a background thread that harvests installer-side secrets and POSTs them to a hardcoded attacker Telegram bot. Observed behaviors: - Reads private keys and credentials from `~/.ssh/` (`id_rsa`, `id_ed25519`, `id_ecdsa`, `id_dsa`), `~/.aws/credentials`, `~/.aws/config`, `~/.gitconfig`, `~/.git-credentials`, `~/.npmrc`, `~/.pypirc`, `~/.dockercfg`, `~/.docker/config.json`, plus gcloud and vscode settings. - Copies Chrome/Edge/Safari `Login Data`, `Cookies`, and `History` SQLite databases to `/tmp` and extracts saved logins, cookies, and browsing his

Which versions of request-cache-py are malicious?

The following PyPI versions of request-cache-py are flagged malicious: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0. Treat any of these as compromised.

How do I remediate request-cache-py if I installed it?

request-cache-py is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed request-cache-py — how do I know if it already compromised me?

If request-cache-py was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

How do I find request-cache-py across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for request-cache-py (11 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging request-cache-py across your stack and pipelines.

Malicious package

request-cache-pyPyPI

Malicious code in request-cache-py (PyPI) Remove it immediately and rotate any exposed credentials.

MAL-2026-6245

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall request-cache-py

What this malware does

request-cache-py impersonates the legitimate requests-cache HTTP caching library. On import request_cache_py, the package's __init__.py starts a background thread that harvests installer-side secrets and POSTs them to a hardcoded attacker Telegram bot.

Observed behaviors:

Reads private keys and credentials from ~/.ssh/ (id_rsa, id_ed25519, id_ecdsa, id_dsa), ~/.aws/credentials, ~/.aws/config, ~/.gitconfig, ~/.git-credentials, ~/.npmrc, ~/.pypirc, ~/.dockercfg, ~/.docker/config.json, plus gcloud and vscode settings.
Copies Chrome/Edge/Safari Login Data, Cookies, and History SQLite databases to /tmp and extracts saved logins, cookies, and browsing history (SELECT origin_url, username_value FROM logins; SELECT host_key, name, value, path FROM cookies).
Iterates os.environ and exfiltrates any variable whose name contains key, token, secret, password, api, or auth.
Posts the collected data to https://api.telegram.org/bot<redacted>/sendMessage with a fixed chat_id. The bot token and chat id are base64-split across pieces and reassembled at runtime to evade scanners.
Includes sandbox-evasion: _should_skip() aborts when CI, GITHUB_ACTIONS, TRAVIS, JENKINS_HOME, CIRCLECI, /.dockerenv, or hypervisor markers are present, restricting execution to real developer workstations. A ~/.cache/.pyrc marker suppresses repeat sends within 24 hours.

The combination — name impersonation of a popular library, import-time credential harvest from classic developer secret paths, browser database theft, env scraping, base64-obfuscated C2, sandbox evasion — is a deliberate supply-chain credential stealer targeting human developers.

During import, package exfiltrates browsers data, SSH keys and other credential files, env variables and other sensitive data.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-request-cache-py

Reasons (based on the campaign):

infostealer
exfiltration-env-variables
exfiltration-ssh-keys
impersonation
A Telegram webhook is used to send collected data.
exfiltration-browser-data
The package contains code to detect if it is running in a sandbox environment.
exfiltration-credentials
The malicious code is intentionally included in a dependency of the package

Malicious versions

11 flagged

1.0.01.0.11.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.0

Indicators of compromise (SHA-256)

d027c4b6379310432f96b48dc78c73ddf1346052c5ab16ea6ed4fe3fc0754d08

4ec4eb5987160de24832dd35975645b14904ca353b22b35740e58aa833ea0b81

81fce5abd64051b0a0b385f15f498a2dbde54baf0b2b5cc58a4948b2485f013a

9c927aa5d62f6f7fa19755c9b10a85001368f6ffa77670da9dccddd806c7d670

eafb96e46544cb1351d26caf52bff79055bc205a1f8454737b677fff8fbc6fea

1a042aecdbbad9d841817b51d6d6f9dde1604ead6fb89a9875318a90cdcf3e7a

3abe06cfd4bc42ce70a746ecbccfcb29e093f620978448c670ab66f0076bc540

240b3bc782609197c032265d3949dd423b923c62219abcac13c6b20f25b0cf95

46a5cf1a09ced54f218679c05284e510d84000f462e69fb7d9afb24c2c0b9415

7a5f558a3ce1a7bbe792e40186a58026a63c2111db5cea0da4325ab69738e604

91443bcf93f3a44ee9df04f686dd8c01eb089e554619ddfd65567feb4b5a67b1

9d603139d5b17fd63334a042e856af66f828f098efab4022b3872241dc0a45b5

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for request-cache-py (11 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging request-cache-py across your stack and pipelines.
If you installed it — respond
request-cache-py is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If request-cache-py was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks request-cache-py before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. request-cache-py on PyPI has been identified as a malicious package (versions 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, and 3 more flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-06-request-cache-pyIN-MAL-2026-007157IN-MAL-2026-007158IN-MAL-2026-007156IN-MAL-2026-007159IN-MAL-2026-007160IN-MAL-2026-007155IN-MAL-2026-008572IN-MAL-2026-008879IN-MAL-2026-008876IN-MAL-2026-008860IN-MAL-2026-008839

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks request-cache-py-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring