Suspicious 80% python Download

beautifyText 1.0.3

C2 beacon, command execution, file exfil

“Text beautification utilities — wrapping, casing, slugify, ANSI styling.”

Captures both process output streamsMultiple Python Base64 decoder calls
SHA-2565b22e3b1ce36e39fcd02c30166a412e601b8fea0dcfc985e9119c2c1287d538b
URLhttps://files.pythonhosted.org/packages/21/c1/5fffb23778d3f511459e84920dc1327e8a48049444c623c93ea4a57cdd81/beautifytext-1.0.3-py3-none-any.whl
MaleculeK(Te)O₄(CDy₂EuS)H₆(Cm₁₁Db₁₂F₄Os₆Po₈Ti)Md₃(In₇Pa₂)

Also flagged by osm (This package implements a full-featured C2 RAT (Remote Access Trojan) disguised as a text beautification utility. The setup.py installs a cmdclass hook that imports beautifyText._compat on installatio…), osv (MAL-2026-17417: Malicious code in beautifytext (PyPI)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.