The package declares malicious dependencies. Their activity is however not triggered as since version 1.0.4, the packages releases lack any source code. Malicious dependency was first introduced in version 1.0.5, but the package is likely prepared to be a loader of malicious code from very begining.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-request-cache-py

Reasons (based on the campaign):

• infostealer

• exfiltration-env-variables

• exfiltration-ssh-keys

• impersonation

• A Telegram webhook is used to send collected data.

• exfiltration-browser-data

• The package contains code to detect if it is running in a sandbox environment.

• exfiltration-credentials

• The malicious code is intentionally included in a dependency of the package