GCVE-110-OSM-2026-12873

During import, the code exfiltrates potentially sensitive env variables. In all analyzed versions the exfiltration target was a localhost, suggesting it was just a test. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: 2026-09-0requests Reasons (based on the campaign): - exfiltration-env-variables - typosquatting Judge assessment: This package looks like a typosquat of requests (`py-1requests`) with burner-style metadata, but the actual code evidence is limited to a single `subprocess.Popen(` hit in `py_1requests/__init__.py`, which is not enough on its own to prove malware. The OSV advisory claims env-var exfiltration, but the provided evidence does not include any exfiltration target or environment-reading code, and the console script entrypoint only prints a message in `py_1requests/cli.py`. Given the minimal metadata and shell execution primitive, a malicious attacker model is plausible, but the current snapshot is insufficient to confirm active theft or delivery. This should be investigated further rather than submitted as confirmed malware. ENTRY py_1requests/cli.py (console-script: 'py_1requests=py_1requests.cli:main') ADDITIONAL FINDINGS - Shell Command Execution in py_1requests/__init__.py: "subprocess.Popen(" PAYLOAD FILES py_1requests/__init__.py