PyPI☠ CRITICALtyposquat⚠ ACTIVE THREAT

reqests

First seen: Jun 3, 2026 0 viewsMimics: requests

Share threat HN

Threat Description

A typosquat of the ubiquitous 'requests' library — a single transposed letter ('reqests' vs 'requests'). Registered versions expose the same API surface so pip-installed code keeps working, while every call's URL, headers, and POST body are mirrored to a collector.极易误装 via fast typing or AI autocomplete.

AI Hallucination Analysis

Likely AI Hallucination60%

Known to be hallucinated by: Copilot, ChatGPT-4

Remediation Guide

Uninstall reqests and install the real requests. 2. Treat every URL/header/body sent during exposure as leaked. 3. Rotate any credentials passed in headers. 4. Enable pip's require-hashes and review requirements.txt for typos.

View on registry

Quick Facts

Ecosystem: PyPI
Risk Level: CRITICAL
Type: typosquat
Status: ACTIVE
Legitimate Package: requests
Hallucination Confidence: 60%

Check My Project

Scan for this package