2026-11-reqnest: Malicious PyPI packages reqnest, reqnests, fhqiouhq, ajfhiuqhfqgwerhuqnfqh exfiltrate Telegram files on import
Severity: critical · Patch status: no-fix-needed · Since 2026-11-07
On 2026-11-07 GitHub's advisory database published four malware advisories for PyPI packages tied to the '2026-11-reqnest' campaign: reqnest (0.1.0), reqnests (0.1.0 and 0.1.1), fhqiouhq (0.1.0), and ajfhiuqhfqgwerhuqnfqh (0.1.0). All execute on import and exfiltrate sensitive Telegram files (session data) to a remote location, classified as infostealer malware with files-exfiltration and typosquatting behavior. Anyone who pip-installed any of these packages and imported them on a machine with Telegram installed is affected; credentials and session files may already be in attacker hands. There are no patched versions — the packages are simply malicious and should be removed. Discovered and reported via kam193's bad-packages project and OpenSSF malicious-packages.
What to do
- Immediately uninstall reqnest, reqnests, fhqiouhq and ajfhiuqhfqgwerhuqnfqh from all environments and purge them from requirements/lockfiles and CI caches
- Assume compromise if any was imported: log out all Telegram sessions, revoke them, and re-authenticate; delete tdata/session files and scan for persistence
- Rotate any credentials, API keys or secrets accessible from affected machines and review access logs for exfiltration
- Audit pip install history and dependency resolution for typosquatting; pin dependencies and verify package names against official sources
Sources
All live incidents on Threat Watch
