Malicious code in reguestsc (PyPI)

A malicious package named reguestsc was discovered on PyPI, identified as a typosquat campaign targeting users of a legitimate library. The package cloned the legitimate library's code but injected malicious functionality.

Upon import, the compromised package downloads and executes a remote executable. Dynamic analysis identified the payload as salatstealer, an infostealer malware designed to exfiltrate sensitive information from infected systems.

The campaign was cataloged as 2026-07-reguestsc and credited to the OpenSSF's malicious-packages repository. The malicious intent is clear: the injected code performs spyware-like behavior characteristic of information-stealing malware.