MAL-2026-17417 Malicious code in beautifytext (PyPI)

beautifytext 1.0.3 imports beautifyText/_compat.py from its init.py and from a setup.py install hook. That module starts a detached background process that registers the host (hostname, user, OS, working directory) with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read and write files, and posts the results back.

beautifyText 1.0.3 is a backdoor disguised as a text utility. On import beautifyText, the package spawns a detached background Python process (via a module named _compat) that decodes a base64-obfuscated C2 URL (https://bleodw.wisp.uno) and enters a long-poll loop against /work/{id}. The command channel implements three job kinds: exec runs arbitrary shell commands via subprocess with shell=True, pull reads arbitrary files from the installer's host, and push writes arbitrary files to the installer's host, with results POSTed back to /result. On registration, host metadata (hostname, OS/release, Python version, USER/USERNAME, current working directory) is sent to /register, and /heartbeat maintains the session. setup.py installs an install and develop cmdclass override whose run() calls _post_install(), which imports beautifyText._compat and triggers the same beacon during pip install, so the backdoor activates on install even without a subsequent import. The C2 host is stored as a base64 literal (_HOST_B64 = aHR0cHM6Ly9ibGVvZHcud2lzcC51bm8=) and decoded at runtime to evade static string matching. The process is detached so it survives parent-process exit.

During import, the package silently spans a separate process that waits for and executes remote commands.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-beautifytext

Reasons (based on the campaign):

• rat

• The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.