PROBABLY_PENTEST (1) campaign cataloged at 2026-09-03(2).

1. Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2026-09-0requests

During import, the code exfiltrates potentially sensitive env variables. In all analyzed versions the exfiltration target was a localhost, suggesting it was just a test.

Abuse categories

exfiltration_env_variables

Campaign uses exfiltration_env_variables.

typosquatting

The package name is an typosquatting variant of a popular package.

Packages in the campaign

campaign:2026-09-0requests

• 0requests
• py-0requests
• py-1requests
• py-2equests