If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (4b829053417a14305f80204983289f120f71abd2472785cd4e2adfe095599003)
The package name 'reqparser' resembles common HTTP client / parsing library names in the Python ecosystem, a shape frequently used by typosquat lures. The tarball contains 3 files, and no concrete installer-harm behavior (credential read, environment scraping, network exfiltration, install-time fetch-and-execute, lifecycle-script exec) could be corroborated in this record. Automated deep tracing did not produce reviewable output for this artifact.
Source: kam193 (982923c14e644e82a839621d37715fd123568fc378aed45b6afa6247bc0b5054)
During the module import, the package starts an infostealer. It exfiltrates data from crypto currency wallets and web browsers, ensures persistence and installs further malware.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-reqparser
Reasons (based on the campaign):
- malware
- persistence
- exfiltration-crypto
- exfiltration-browser-data
- The package contains code to detect if it is running in a sandbox environment.
- infostealer
- keylogger
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://www[.]dropbox[.]com/scl/fi/vlzgfg9rrbgwvn0ne37hx/VapeInjector[.]exe?rlkey=7kvgnqgggx45p7j3e3watnecr&st=0xnfj0jj&dl=1 other packages →
- hxxps://discord[.]com/api/webhooks/1551389643809759282/6tikdocvfNvYsh-HDur00-hrQrwdBBByvfDXz3sNLB-XXBSPOGGGzd-rxC6jGe_eAb7q other packages →