Code execution via malicious request dependency

A malicious dependency in watools 0.0.1 through 0.0.8 allows attackers to execute code and access sensitive data through the request package. The package dependency metadata names the malicious request package instead of the legitimate requests package, causing pip to retrieve attacker-controlled code when that dependency remains available. Installing watools from an index or mirror that still serves request exposes user information and digital-currency keys and enables privilege escalation.