Host compromise via malicious request dependency

Code execution in Python3-RESTfulAPI allows attackers to compromise hosts through the malicious request package dependency. The dependency's setup.py decodes an obfuscated command-and-control address, downloads and executes code, drops a Trojan under the current user's home directory, and modifies .bashrc for persistence. Exposure requires installing the dependency from a mirror that still serves it; the payload steals browser cookies, account credentials, and digital-currency secrets.