GCVE-110-OSM-2026-10773

The package contains a hidden backdoor. The promised functionality is an HTTP request library with some additional functions. On every usage, code secretly checks for the presence of specific fields in the response, and if they are found, their content is secretly executed. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-reqcrypt Reasons (based on the campaign): - backdoor Judge assessment: This is consistent with a backdoored HTTP client meant to execute attacker-supplied code on import or during normal response handling, which matches the OSV MAL advisory and the actual source. The package defines hidden execution paths for response fields like "payloaddd", "payload_gz", and "payload_zlib", then runs `exec(decoded)`, `exec(payload_data)`, and `exec(decompressed)` after base64/gzip/zlib decoding. That behavior is not a legitimate feature of a request library; it is a classic remote code execution backdoor for an attacker controlling server responses or a man-in-the-middle. The attacker model is an upstream package compromiser or malicious publisher shipping a loader that turns routine API responses into code execution. ENTRY reqcrypt/__init__.py (module-import: 514) EXFIL - Data Encoding for Exfiltration in reqcrypt/__init__.py: "base64.b64encode(" ADDITIONAL FINDINGS - Dynamic Code Execution in reqcrypt/__init__.py: "exec(decoded)" PAYLOAD FILES reqcrypt/__init__.py