httpz-requests

Source: amazon-inspector (004770b4da0c6705f95ef2c8654fd81d37650ffacaad7160041bded02cdb7fbc)
httpz-requests exposes a Telegram bot (`start_bot`, `run_cmd_enc`, `http_request`) whose message handler executes arbitrary shell commands on the host running the package, granting a remote Telegram operator full command execution under the installer's user account. Documented remote commands include arbitrary shell execution (`chalao`, `.sh <command>`, `.py <file>`, `.exec <file>`), destructive filesystem operations (`rm -rf <path>`), single- and bulk-file exfiltration (`take <file>`, `take all`), a full-host backup mode that produces split 50MB archives with `.partNNN` chunking (`get all`), and environment-variable dumping (`.printenv`) — collectively enabling remote theft of filesystem contents and process-environment secrets (cloud, CI, and API credentials). The package is shipped only as compiled Cython `.so` files with no Python source, and self-describes obfuscation features that XOR+base64-encode command strings and disguise execution as `http_request("POST",...)` so plaintext commands do not appear in `ps` or system logs; the Telegram bot token is stored encoded and decoded at runtime by `dec()`. The distribution name `httpz-requests` and import name `httpz_requests` resemble the top-100 PyPI package `requests` while presenting a Telegram remote-shell API instead of an HTTP client, and metadata is unfilled boilerplate (author `Aapka Naam <you@example.com>`, homepage `https://github.com/YOUR_GITHUB_USERNAME/httpz-requests`).

Source: kam193 (38eff923106836997e28de6d7173a1553da126be230b341fe64f0c4c215769a2)
The package provides Telegram-based remote access to the machine it runs on. It was deliberately created and used to hack other machines, exfiltrate files and credentials. This package automatically ensures persistence and starts a malicious process on import.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-httpz-requests

Reasons (based on the campaign):

- files-exfiltration

- rat

- persistence

- uses-telegram-bot

- obfuscation

- native-extension