beautifytext

{"schema_version":"1.7.4","id":"MAL-2026-17417","published":"2026-09-30T11:47:45Z","modified":"2026-10-08T20:22:24.993652430Z","summary":"Malicious code in beautifytext (PyPI)","details":"beautifytext 1.0.3 imports beautifyText/_compat.py from its __init__.py and from a setup.py install hook. That module starts a detached background process that registers the host (hostname, user, OS, working directory) with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read and write files, and posts the results back.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (488a492f2e87fa16d545c2605cb1ca4eb18c5e912a8e1645248e7ababafc10f8)\nbeautifyText 1.0.3 is a backdoor disguised as a text utility. On `import beautifyText`, the package spawns a detached background Python process (via a module named `_compat`) that decodes a base64-obfuscated C2 URL (https://bleodw.wisp.uno) and enters a long-poll loop against `/work/{id}`. The command channel implements three job kinds: `exec` runs arbitrary shell commands via subprocess with `shell=True`, `pull` reads arbitrary files from the installer's host, and `push` writes arbitrary files to the installer's host, with results POSTed back to `/result`. On registration, host metadata (hostname, OS/release, Python version, USER/USERNAME, current working directory) is sent to `/register`, and `/heartbeat` maintains the session. setup.py installs an `install` and `develop` cmdclass override whose `run()` calls `_post_install()`, which imports `beautifyText._compat` and triggers the same beacon during `pip install`, so the backdoor activates on install even without a subsequent import. The C2 host is stored as a base64 literal (`_HOST_B64 = aHR0cHM6Ly9ibGVvZHcud2lzcC51bm8=`) and decoded at runtime to evade static string matching. The process is detached so it survives parent-process exit.\n\n## Source: kam193 (cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b)\nDuring import, the package silently spans a separate process that waits for and executes remote commands.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-07-beautifytext\n\n\nReasons (based on the campaign):\n\n\n - rat\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n","affected":[{"package":{"name":"beautifytext","ecosystem":"PyPI"},"versions":["1.0.3","1.0.4","1.0.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"beautifyText/_compat.py","sha256":"0e0e68803dbe0578c687d27da0883df9e4780137646d76f3580761809c387957","tlsh":"72e141b0f95868b2f3a2e16d4454906513aebd077a4669b0be4cb2682fdd039c0f41fd"},{"path":"setup.py","sha256":"2ed1c51398722e453a3dcbea3363df4e43b25e0d24cfa81632f1d3b5ff55298e","tlsh":"6c01bdc2d8652838b84293d806d350e69b32a913bdb0b7ad36df431a1fc706686561af"}],"package_integrity":[{"filename":"beautifytext-1.0.4-py3-none-any.whl","hashes":{"blake2b_256":"e742ee91a51d346c70c0bd3c91e6d3d0981a1d865d65b4f8a9b527c4c642239e","md5":"bbce880b0a1a28095af50ac5357951bb","sha256":"352a26be5f89efb4eeeb57d7a477532d36224f9d70761128c69c78402707adf7"}},{"filename":"beautifytext-1.0.4.tar.gz","hashes":{"blake2b_256":"88592bbcf82766552ccc68ffab2970c24b421f63140614fa75f389700ddf4476","md5":"dcccae916ea174abd5bfaaed5246bcef","sha256":"bcaf10dfc114d1ca540bc3a0add97844448ab94a01570004d33e6f0de4df459f"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/beautifytext"},{"type":"PACKAGE","url":"https://pypi.org/project/beautifyText/1.0.4/"},{"type":"PACKAGE","url":"https://pypi.org/project/beautifyText/1.0.7/"},{"type":"PACKAGE","url":"https://pypi.org/project/beautifyText/1.0.3/"}],"database_specific":{"iocs":{"domains":["bleood.wisp.uno"],"urls":["https://bleodw.wisp.uno"]},"malicious-packages-origins":[{"id":"pypi/2026-07-beautifytext/beautifytext","import_time":"2026-09-30T19:40:14.775642175Z","modified_time":"2026-09-30T19:15:23.492694Z","sha256":"cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b","source":"kam193","versions":["1.0.3","1.0.4","1.0.7"]},{"id":"IN-MAL-2026-021229","import_time":"2026-10-08T20:20:20.144764993Z","modified_time":"2026-10-08T20:00:43Z","sha256":"c8181de3b2eec9e345e33a0924b1387e4263dd4f1826618df002ac8376de9998","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-021231","import_time":"2026-10-08T20:20:20.240491162Z","modified_time":"2026-10-08T20:01:04Z","sha256":"0a59c3a7944769221a5478c3b40086b0855722f357780579b17087e609259b29","source":"amazon-inspector","versions":["1.0.7"]},{"id":"IN-MAL-2026-021230","import_time":"2026-10-08T20:20:20.201958844Z","modified_time":"2026-10-08T20:00:52Z","sha256":"488a492f2e87fa16d545c2605cb1ca4eb18c5e912a8e1645248e7ababafc10f8","source":"amazon-inspector","versions":["1.0.3"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"smiling-hyena","contact":["smilinghyena4@gmail.com"],"type":"FINDER"}]}