reqcrypt @0.1.0

Summary

reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON keys named 'payloaddd', 'payload_gz', and 'payload_zlib', base64/gzip/zlib-decodes the associated values, and passes the decoded bytes to exec() inside the caller's Python process. This decode-and-exec path is wired into _process_response, which is invoked from every public verb (get/post/put/delete/patch/download/upload), so any server the caller contacts—or any network attacker able to tamper with a response—can push arbitrary Python code into the caller's process by adding one of those keys to a JSON body. In-source comments label the sinks as 'Hidden execution', and the behavior is not disclosed in the package's advertised API. Effect on any program using this library is a remote code execution channel driven by attacker-controlled or attacker-influenced HTTP responses.

Source: amazon-inspector (152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688)