# Check requirements.txt for malicious PyPI packages > Paste your requirements.txt to check it against known malicious PyPI package releases. Free, no signup, and runs entirely in your browser. - File: requirements.txt - Package manager: pip - Registry: PyPI - Match precision: exact versions (lockfile) - Coverage: 84 tracked incidents, 531 flagged packages on PyPI - Scanner: https://dependencywatch.io/check/requirements-txt (runs in the browser; the file is never uploaded) requirements.txt is the most common way Python projects declare dependencies, and how precise an answer we can give depends entirely on whether you pinned versions. Exact pins give a confirmed answer; unpinned entries give an advisory. ## What we read from this file - exact pins - `mistralai==2.4.6` - ranges and compatible-release specifiers - `urllib3>=1.26,<2.0`, `numpy~=1.26.0` - extras and environment markers - `requests[security]==2.31.0`, `black; sys_platform == "darwin"` - bare entries with no version, reported as advisories rather than findings ## How confident is a match? Entries pinned with `==` give a confirmed answer. Entries with a range, or with no version at all, are reported separately as advisories - we can tell you the package has had compromised releases, but not whether you installed one. ## Unpinned dependencies cannot be confirmed A bare `aioquic` line tells pip to install whatever is newest at the time. We cannot know which version landed on your machine, so we surface it as an advisory: this package has had malicious releases, go and check what you actually have installed with `pip show`. ## Install-time execution is the norm on PyPI A large share of the PyPI incidents we track execute during installation via `setup.py` or a build hook, rather than waiting to be imported. `pip install` is enough to detonate them, which means a failed or cancelled install still counts as exposure. ## Name collisions across ecosystems are real Some names exist on both npm and PyPI - `mistralai` is a live example in our own database. We match strictly within the PyPI ecosystem for this file, so a compromised npm package of the same name will not produce a false positive here. ## Frequently asked questions ### What if my requirements.txt has no pinned versions? We still check it, but the result is an advisory rather than a confirmed finding - we can tell you a package has had malicious releases without knowing which version you installed. Run `pip freeze > requirements-lock.txt` and paste that instead for a definitive answer. ### Does this check Poetry, Pipenv, or uv lockfiles? Not yet - today we read requirements.txt and the npm-ecosystem lockfiles. The practical workaround is to export: `poetry export -f requirements.txt`, `pipenv requirements`, or `uv export --format requirements-txt`, then paste the result. ### Does `pip-audit` or Safety already cover this? They mostly cover known *vulnerabilities* in legitimate packages, drawing on advisory databases. Deliberately malicious packages are usually yanked from PyPI within hours of discovery, and after that a vulnerability lookup often returns nothing while the malicious version is still pinned in your file and cached in your internal mirror. We match the malicious releases directly. ### I installed one of these. Is uninstalling enough? No. Assume anything readable by that process was taken - environment variables, API tokens, SSH keys, cloud credentials. Rotate them from a different machine, then uninstall and clear your pip cache and any internal mirror that may still be serving the yanked release. ## Recent PyPI incidents The most recent of 84 tracked incidents affecting this ecosystem. Full feed: https://dependencywatch.io/feed - 2026-10-13 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-13 (**Baileys/libsignal lure operator wave 3** - 60+ npm packages across `@revizahoshii/*`, `@fazzcodestudio/*`, `@sanzoffc/*`, `@wanzlonely/*`, `@mikudeveloper/*`, `@modss/*`, `@ikanngeming/*`, `@fhkryxv/*`, `@saazkira/*`, `@badzz88/*`, `@alipclutch/*`, `@mivesensei/*`, `@kanaraa/*`, `@chatunity/*`, `@zanta/*`, `@yudzxml/*`, `@zeronexcode/*`, plus `baileys-xbats`/`bailslonely`/`nakkinpm`/`amprem` unscoped - all CWE-506 boilerplate takedowns against `@WhiskeySockets/Baileys` WhatsApp-automation lures; **confirmed-payload carve-outs within the sweep**: PyPI `npp-ml` Notepad++ impersonator deploying ADExplorer AD-recon tool, PyPI `minecraftaccfinder` Gmail/Roblox/Discord/Minecraft infostealer+RAT with keylogger/screenshots/browser-creds, RubyGems `wallet-balance-scanner` fake-native-extension reverse-shell to hardcoded endpoint; **s4yhii wave 3 continuation** `@s4yhiitestpoc/r2-https-b` on `collector.oob.s4yhii.com`; plus 25+ dep-confusion probes at `99.x`/`100.x`/`101.x` sentinels: `@myorder-frontend-commons/*`, `risk-detection`, `unified-platform`, `@pinecone-experience/*`, `@airbnb-extended/*`, `@tesla-insurance/*`, `@user-services/*`, `app-sca-info-banking`, `com.apple.unityplugin.storekit` Apple-brand impersonator, and more)](https://dependencywatch.io/incident/multi-2026-10-13-ghsa-malware-sweep) - 2026-10-12 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-12 (**s4yhii operator wave 3**: 8 npm packages across `@s4yhiitestpoc/*` + `@coopeuch/*` Coopeuch-brand dep-confusion all beaconing `collector.oob.s4yhii.com/_npm-poc/beacon`; **`185.158.107.175:8787/_ah/dc` operator wave 2**: 6 npm `beacon.cjs`-pattern recon packages (`nitro-cjs-requirer`, `nitro-bundled-dep`, `nested-lib`, `cloudflare_module`, `another-very-long-name`, `some-very-long-package-name`); **`64.181.165.115/dc` native-addon operator**: 4 npm packages with HTTP/1.0 raw-socket beacons (`ksp-app`, `ksp-client-registry`, `pay-methods-kmf`, `deposit-limit-fe`); `liferay-workspace-scripts` bundled-dep from `ltidi.storage.googleapis.com/depenconf/`; `react-dropzone-v4`/`react-paginate-v5`/`kmf-vendor-pack`/`exodus-firestore-synchronize` dep-confusion probes; `hardhat-option@2.0.1` npm `hardhat-promised`-family stealer; `css-nesting-transform@1.0.0` Wix-brand `webhook.site` recon; PyPI `ig-gox` (`goxtools.shop` encrypted-loader) + `py2ops` trojaned-REPL. Big RubyGems wgkit wave-2 crypto cluster split out to its own carve-out.)](https://dependencywatch.io/incident/multi-2026-10-12-ghsa-malware-sweep) - 2026-10-11 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-11 (new `webreader` + `pafer` PyPI two-package pickle-execution RAT with disclosed `frjmzbjbhwvtdnsuodmu.supabase.co` + `api.npoint.io/40e32d283a9d97e59252/a` C2 and `.pth` persistence, where the main package hides the pickle and the mandatory dependency unpickles it; new `agentaix` PyPI 3-package first-publish RAT cluster (`agentaix`, `agent-vx`, `media-manager5`) with autorun persistence beaconing `googleforum.pythonanywhere.com`; and standalone `@library-wide/library-shell@99.9.1` npm dep-confusion sentinel flagged by OpenSSF Package Analysis for malicious-domain egress)](https://dependencywatch.io/incident/multi-2026-10-11-ghsa-malware-sweep) - 2026-10-10 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-10 (new `s4yhii` native-binary credential-stealer dep-confusion operator - 16 npm packages across `@galicia-toolkit-nestjs/*`, `@galicia-toolkit-nestjs-20/*`, `@galicia-toolkit-nestjs-20-lite/*`, `@galicia-toolkit-cheques-nc/*`, `@brick-v2/*` loading prebuilds/-/metrics.node ELF+PE that forks+setsid and exfils AWS/GitHub/npm/Azure DevOps/Actions tokens to oob.s4yhii.com/native; `@tunstock/remact-dom@19.2.0` react-dom typosquat with confirmed `tele.metry.orgin.net/api/v1/events` beacon; Baileys/libsignal lure continuation `@fer2809fl/baileys`+`cloud-baileys`+`arsya-baileys`+10-package `asepxyz*` cluster; crates.io `sharpnes` Telegram-Desktop + Chrome-extension/wallet infostealer (first cargo malware advisory this week); 3-package `kmf-*` + 2-package internal-frontend dep-confusion with oast.pro OAST; 5-package `@tvg-mar/*` dep-confusion probes; 2 Tailwind typosquats; plus pypi `ig-gox` Instagram abuse)](https://dependencywatch.io/incident/multi-2026-10-10-ghsa-malware-sweep) - 2026-10-09 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-09 (xwise8887 wave-2 continuation `wie888r`/`testrrrd`/`xblaxw`/`@wxwxtest/testrrrdd` to `185.158.107.175:8787/_ah/dc`; Wix dep-confusion cluster `wix-reg-poc-bypass` (webhook.site) + `css-overscroll-contain` (dxpoc.gt.tc, K8s SA-token theft + container escape); `pxnpm` nfjbill-operator npm proxy weaponization (same operator as 2026-08 `yakuza0`); 16-package `@bellaxchuu/*` + sibling Baileys-themed lure cluster; 6-package `@dransay/*` oast.site dep-confusion probes; `@bitwardne/*` 2-package Bitwarden typosquat; 5-package `@galicia-toolkit/*`+`@design-system-coopeuch/web` dep-confusion cluster; 9 dev-tooling typosquats; 2 pypi `kafka-roller`/`kafka-helmsman` 99.x dep-confusion probes; plus standalones)](https://dependencywatch.io/incident/multi-2026-10-09-ghsa-malware-sweep) - 2026-10-07 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-07 (wave-2 continuation of 2026-10-05 operators: npm `hardhat-init` pino-impersonator jsonspack sibling of yesterday`s `hardhat-roof`/`hardhat-plus`, npm `css-jptvix-polyfill` Wix dep-confusion recon + NEW `appsecc.com/js` reverse-shell second stage, npm `@pinecone-experience/messages@99.9.1` Pinecone-impersonator tarball-URL install-RCE from `ltidi` GCS bucket, 4-package npm `internallib_v23/30/86/875` RFC1918 `10.0.19.80` reverse-shell cluster, pypi `lore-cs` HackerOne-bugbounty dep-confusion probe, plus 2 CWE-506 boilerplate takedowns `@kxa/xbails` and `captchetat-angularv8`)](https://dependencywatch.io/incident/multi-2026-10-07-ghsa-malware-sweep) - 2026-10-06 · [high, advisory sweep] [GitHub Advisory malware sweep - 2026-10-06 (3 fresh advisories: pypi `zencleaner` Discord-webhook infostealer + Windows event-log wipe, npm `virgil-cli` runtime conversation/shell-output exfil to api.nm-streetwear.space, npm `dotenv-async` CWE-506 boilerplate takedown; plus 2026-10-05 backfill: 2 npm `@inpeek/odata*` dep-confusion probes at 99.99.99-102 sentinel versions, pypi `erc7730-hackathon@99.0.0` OpenSSF-flagged PROBABLY_PENTEST probe; 25-gem RubyGems Ethereum/crypto wgkit cluster from 2026-10-05 SPLIT OUT)](https://dependencywatch.io/incident/multi-2026-10-06-ghsa-malware-sweep) - 2026-10-05 · [high, typosquat] [pip `anthropic-sdk` typosquat of Anthropic`s official `anthropic` SDK - credentials, env vars, AI chat files, SSH keys exfiltrated over HTTPS and DNS (OpenSSF campaign `2026-10-anthropic-sdk`, GHSA-xxp4-7566-29xj)](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat) ## Other manifest formats - package-lock.json (npm): https://dependencywatch.io/check/package-lock-json - package.json (npm): https://dependencywatch.io/check/package-json - yarn.lock (Yarn): https://dependencywatch.io/check/yarn-lock - pnpm-lock.yaml (pnpm): https://dependencywatch.io/check/pnpm-lock-yaml --- Canonical page: https://dependencywatch.io/check/requirements-txt Markdown version: https://dependencywatch.io/check/requirements-txt.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).