beautifytext

Details

beautifytext 1.0.3 imports beautifyText/_compat.py from its __init__.py and from a setup.py install hook. That module starts a detached background process that registers the host (hostname, user, OS, working directory) with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read and write files, and posts the results back.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (488a492f2e87fa16d545c2605cb1ca4eb18c5e912a8e1645248e7ababafc10f8)
beautifyText 1.0.3 is a backdoor disguised as a text utility. On `import beautifyText`, the package spawns a detached background Python process (via a module named `_compat`) that decodes a base64-obfuscated C2 URL (https://bleodw.wisp.uno) and enters a long-poll loop against `/work/{id}`. The command channel implements three job kinds: `exec` runs arbitrary shell commands via subprocess with `shell=True`, `pull` reads arbitrary files from the installer's host, and `push` writes arbitrary files to the installer's host, with results POSTed back to `/result`. On registration, host metadata (hostname, OS/release, Python version, USER/USERNAME, current working directory) is sent to `/register`, and `/heartbeat` maintains the session. setup.py installs an `install` and `develop` cmdclass override whose `run()` calls `_post_install()`, which imports `beautifyText._compat` and triggers the same beacon during `pip install`, so the backdoor activates on install even without a subsequent import. The C2 host is stored as a base64 literal (`_HOST_B64 = aHR0cHM6Ly9ibGVvZHcud2lzcC51bm8=`) and decoded at runtime to evade static string matching. The process is detached so it survives parent-process exit.

## Source: kam193 (cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b)
During import, the package silently spans a separate process that waits for and executes remote commands.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-07-beautifytext


Reasons (based on the campaign):


 - rat


 - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

Compromised versions (3)

• 1.0.3
• 1.0.4
• 1.0.7

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.