Suspicious 80% python Download

beautifyText 1.0.7

Remote command execution beacon

“Text beautification utilities — wrapping, casing, slugify, ANSI styling.”

Captures both process output streamsMultiple Python Base64 decoder calls
SHA-25653cadabf3e61483a09aa48a40019318e531c5d7b59872d36797041261d41c862
URLhttps://files.pythonhosted.org/packages/36/3e/2d308f3f17acff579a805cd39461d51eb4663c432d04c382afae5ce8c143/beautifytext-1.0.7-py3-none-any.whl
MaleculeK(Te)O₄(C₂Dy₂EuS)H₆(Cm₁₃Db₁₂F₄Os₆Po₈Ti)Md₃(In₇Pa₂)

Also flagged by osm (This package implements a full-featured C2 RAT (Remote Access Trojan) disguised as a text beautification utility. The setup.py installs a cmdclass hook that imports beautifyText._compat on installatio…), osv (MAL-2026-17417: Malicious code in beautifytext (PyPI)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.