diff --git a/pkgs/development/python-modules/badsecrets/default.nix b/pkgs/development/python-modules/badsecrets/default.nix
index d2eed4774527..734a80b35e4d 100644
--- a/pkgs/development/python-modules/badsecrets/default.nix
+++ b/pkgs/development/python-modules/badsecrets/default.nix
@@ -1,49 +1,48 @@
 {
   lib,
+  blasthttp,
   buildPythonPackage,
   colorama,
   django,
   fetchFromGitHub,
   flask-unsign,
-  poetry-core,
-  poetry-dynamic-versioning,
+  hatchling,
   pycryptodome,
   pyjwt,
   requests,
-  viewstate,
+  yara-python,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "badsecrets";
-  version = "0.13.47";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "blacklanternsecurity";
     repo = "badsecrets";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-Yvd9AGbVDOfXep8y+XzwYP2EpTvy+rwyz5hRIe7v4oc=";
+    tag = finalAttrs.version;
+    hash = "sha256-fhRQvVb+JUP1DyTMAV7leIAKD/L4kRhGFYtD78cYABI=";
   };
 
   pythonRelaxDeps = [
     "django"
-    "viewstate"
+    "pyjwt"
   ];
 
-  build-system = [
-    poetry-core
-    poetry-dynamic-versioning
-  ];
+  build-system = [ hatchling ];
 
   dependencies = [
+    blasthttp
     colorama
     django
     flask-unsign
     pycryptodome
     pyjwt
     requests
-    viewstate
-  ];
+    yara-python
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   pythonImportsCheck = [ "badsecrets" ];
 
diff --git a/pkgs/development/python-modules/blasthttp/default.nix b/pkgs/development/python-modules/blasthttp/default.nix
new file mode 100644
index 000000000000..48c79b7adbba
--- /dev/null
+++ b/pkgs/development/python-modules/blasthttp/default.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  cargo,
+  fetchPypi,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  pytest-asyncio,
+  pytestCheckHook,
+  rustc,
+  rustPlatform,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "blasthttp";
+  version = "0.9.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-JuoGy+QdBsVPMtD0T4Y/NSoeJcO7dwg3HmpqHxTxCIc=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-1+OFAD9n8JntZSV+PZbYLPRM/XDlFwgrEMFGv/LzTN8=";
+  };
+
+  postPatch = ''
+    # The bundled .cargo/config.toml sets OPENSSL_DIR to a relative path
+    rm .cargo/config.toml
+  '';
+
+  __darwinAllowLocalNetworking = true;
+
+  env = {
+    OPENSSL_NO_VENDOR = "1";
+  };
+
+  build-system = [
+    cargo
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  buildInputs = [ openssl ];
+
+  nativeCheckInputs = [
+    openssl
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "blasthttp" ];
+
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    "tests/python/test_ssl_verify.py"
+    "tests/python/test_response_api.py"
+  ];
+
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    "test_redirect_onto_proxied_host_reevaluates_no_proxy"
+    "test_redirect_onto_no_proxy_host_reevaluates_to_direct"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Offensive-first HTTP library";
+    homepage = "https://pypi.org/project/blasthttp";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 094ddce8cfab..83f0e6b08cdb 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2144,6 +2144,8 @@ self: super: with self; {
 
   blake3 = callPackage ../development/python-modules/blake3 { };
 
+  blasthttp = callPackage ../development/python-modules/blasthttp { };
+
   ble-serial = callPackage ../development/python-modules/ble-serial { };
 
   bleach = callPackage ../development/python-modules/bleach { };