Suspicious 85% python Download

pdftl 0.23.0

Obfuscated install hook in package

“A capable CLI tool for PDF manipulation inspired by pdftk.”

Anomalous package runs an obfuscated install hooktutorial text (recognized-context guard)
SHA-256e1dce974c307561748d94027e917934850e9db8a2294fd23e597c5541fb9fb15
URLhttps://files.pythonhosted.org/packages/df/99/6a288411f02084cb964d2b3f52fb3d7e2bd65cb0206da115f9232a4c057d/pdftl-0.23.0-py3-none-any.whl
MaleculeO₅(S₂AsC₃LaXe)H₆(Cr₂Db₃DsFOs₃Po₄)Md(Pt)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.