In 2020 Tencent Onion Anti-Intrusion System detected the upload of the typo-squatting package request, which tries to impersonate the legitimate requests package. Even though the package was removed, some mirrors did not delete the malicious package. Now, in 2022, multiple developers seem to have made the honest mistake of a typo: a GitHub issue reports a code execution backdoor in version 1.2 of keep, which depends on request (CVE-2022-30877). BleepingComputer found the same misspelled dependency in pyanxdns 0.2 (CVE-2022-30882) and api-res-py 0.1 (CVE-2022-31313), and showed that request pulls in a remote access trojan plus an info-stealer that goes after passwords saved in Chrome, Firefox, Yandex and Brave. With keep averaging over 8,000 downloads a week, that is an expensive missing “s”.
