Static pattern: py-requests-post — 1 caught | Cremit

AUTO-PUBLISHED/pypi/2026-06-07

domain-admin@1.6.78

by Peng Shiyu

a domain ssl cert admin

steals →Chromium logins→ sends tohttps://pypi.org/simple

child-process-spawnpy-pip-install-runtimereads-env-varspy-requests-postpy-socket-connectlong-base64-literallong-hex-literalclipboard-access+6

→ Encoded payload + dynamic execution combo (event-stream / flatmap-stream shape) — embedded blob decoded and executed at install time. Fast-tracked.

weekly

310

/wk

llm verdict

malicious 0.92

h-score

patterns

size

1.8 MB

versions

211

AUTO-PUBLISHED/npm/2026-06-05

@ngocsangairvds/vsaf@4.2.9

by ngocsangairvds

logging step

steals →AI API keys

reads-env-varschild-process-spawnreads-ai-api-keyspy-urllib-requestpy-sys-platform-branchpy-pip-install-runtimecurl-pipe-bashwebhook-bin+2

→ 정적 분석기가 curl-pipe-bash 패턴 검출 — 설치 경로에 원격 코드 실행 형태가 그대로 드러남.

weekly

—

/wk

llm verdict

malicious 0.95

h-score

patterns

size

10.3 MB

versions

115

AUTO-PUBLISHED/pypi/2026-06-04

azure-genome@0.1.4

A Python package for Azure Genome.

steals →Chromium logins→ sends tohttps://github.com/python/cpython/pull/119891

py-requests-postreads-env-varseval-dynamicchild-process-spawnreads-homedirreads-system-infowebhook-binpy-socket-connect+6

weekly

/wk

h-score

patterns

size

3.2 MB

versions

AUTO-PUBLISHEDHigh blast/pypi/2026-06-04

sealights-python-agent@2.10.10

by Tricentis Sealights

Tricentis Sealights Python Agent - Quality Intelligence and Code Coverage

steals →Chromium logins→ sends tohttps://packaging.python.org/en/latest/distributing.html

py-pip-install-runtimereads-env-varspy-urllib-requestfs-recursive-readreads-homedirreads-system-infowebhook-binpy-socket-connect+8

weekly

11K

/wk

h-score

patterns

size

1.9 MB

versions

175

AUTO-PUBLISHED/pypi/2026-06-03

quasarr@4.5.3

Quasarr connects JDownloader with Radarr, Sonarr and Magazarr. It also decrypts links protected by CAPTCHAs.

steals →Chromium logins→ sends tohttps://github.com/rix1337

reads-env-varschild-process-spawnbase64-decodepy-requests-postreads-chromium-credspy-socket-connecthex-decodediscord-webhook+1

weekly

—

/wk

h-score

patterns

size

1.3 MB

versions

214

AUTO-PUBLISHED/pypi/2026-05-31

cscc-glass-house@1.0.1

Cloud Security Championship CI test utilities

steals →Chromium logins→ sends tohttps://webhook.site/52335eaa-cdad-436b-a67e-08481a95bd0e

reads-chromium-credsreads-env-varswebhook-binpy-requests-post

→ 의심 전송지 없음, 원격 실행 형태 없음 — no network destinations.

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

1.8 KB

versions

AUTO-PUBLISHEDOSV advisory/pypi/2026-05-22/MAL-2026-4774

vulndify-mcp-server@0.3.0

A minimal MCP server demo exposing a hello tool.

→ sends tohttp://10.37.1.177/v1/chat-messages

base64-decodechild-process-spawncurl-pipe-bash-unverifiedpy-requests-post

→ 의심 전송지 없음, 원격 실행 형태 없음 — extraction empty.

weekly

312

/wk

llm verdict

benign 0.85

h-score

patterns

size

71.4 KB

versions

AUTO-PUBLISHEDOSV advisory/pypi/2026-05-18/MAL-2026-4772

txdpy@2026.5

by 唐旭东

→ sends toapi.fanyi.baidu.com · http://api.fanyi.baidu.com/api/trans/vip/translate?q={q}…

eval-dynamicchild-process-spawnreads-env-varspy-requests-post

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

38.0 KB

versions

AUTO-PUBLISHEDOSV advisory/pypi/2026-05-19/MAL-2026-4765

qontract-reconcile@0.10.2.dev658

Collection of tools to reconcile services with their desired state as defined in the app-interface DB.

steals →AWS keysChromium logins

reads-env-varsreads-aws-credsbase64-decodereads-chromium-credspy-requests-postchild-process-spawnpy-urllib-requestreads-homedir+2

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

8.3K

/wk

llm verdict

benign 0.85

h-score

patterns

size

895.3 KB

versions

2842

AUTO-PUBLISHEDOSV advisory/pypi/2026-05-26/MAL-2026-4813

noteparse@1.1.27

by maoyuyan

a package for parse html to noteinfo

→ sends tohttps://github.com/m294567571/noteparse.git

public-github-pushreads-homedirarchive-then-uploadpy-requests-post

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

30.0 KB

versions

AUTO-PUBLISHEDOSV advisory/pypi/2026-05-25/MAL-2026-4755

mathepy@7.9.0

Module for Quick Calculations

eval-dynamicpy-requests-postpy-pip-install-runtime

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s), 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

49.1 KB

versions

AUTO-PUBLISHEDOSV advisory/pypi/2026-05-26/MAL-2026-4748

eplang@8.0.0

EPL - English Programming Language: write code in plain English. Build apps, web servers, and more.

steals →AWS keysGitHub PATChromium logins→ sends tohttp://localhost:11434

child-process-spawnfs-recursive-readpy-pip-install-runtimepy-urllib-requestclipboard-accessreads-github-tokensreads-env-varsreads-homedir+11

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s), 2 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

952.4 KB

versions

AUTO-PUBLISHEDOSV advisory/pypi/2026-05-25/MAL-2026-4747

edison-tools@0.1.17

→ sends tohttps://edison-k8.vercel.app/query

reads-env-varspy-requests-postpy-urllib-request

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

2.0 KB

versions

AUTO-PUBLISHEDOSV advisory/pypi/2026-05-17/MAL-2026-4741

aurafarmer@0.3.0

PRO — Terminal AI Coding Agent by SPRUKY

py-setup-cmdclasspy-urllib-requestchild-process-spawnpy-requests-post

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

weekly

—

/wk

llm verdict

benign 0.85

h-score

patterns

size

15.1 KB

versions