MAL-2026-17417

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/beautifytext/MAL-2026-17417.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17417
Published
2026-09-30T11:47:45Z
Modified
2026-10-08T20:30:04Z
Summary
Malicious code in beautifytext (PyPI)
Details

beautifytext 1.0.3 imports beautifyText/_compat.py from its init.py and from a setup.py install hook. That module starts a detached background process that registers the host (hostname, user, OS, working directory) with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read and write files, and posts the results back.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (488a492f2e87fa16d545c2605cb1ca4eb18c5e912a8e1645248e7ababafc10f8)

beautifyText 1.0.3 is a backdoor disguised as a text utility. On import beautifyText, the package spawns a detached background Python process (via a module named _compat) that decodes a base64-obfuscated C2 URL (https://bleodw.wisp.uno) and enters a long-poll loop against /work/{id}. The command channel implements three job kinds: exec runs arbitrary shell commands via subprocess with shell=True, pull reads arbitrary files from the installer's host, and push writes arbitrary files to the installer's host, with results POSTed back to /result. On registration, host metadata (hostname, OS/release, Python version, USER/USERNAME, current working directory) is sent to /register, and /heartbeat maintains the session. setup.py installs an install and develop cmdclass override whose run() calls _post_install(), which imports beautifyText._compat and triggers the same beacon during pip install, so the backdoor activates on install even without a subsequent import. The C2 host is stored as a base64 literal (_HOST_B64 = aHR0cHM6Ly9ibGVvZHcud2lzcC51bm8=) and decoded at runtime to evade static string matching. The process is detached so it survives parent-process exit.

Source: kam193 (cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b)

During import, the package silently spans a separate process that waits for and executes remote commands.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-beautifytext

Reasons (based on the campaign):

  • rat

  • The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

Database specific 
{
    "iocs":  {
        "domains":  [
            "bleood.wisp.uno"
        ],
        "urls":  [
            "https://bleodw.wisp.uno"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-07-beautifytext/beautifytext",
            "import_time":  "2026-09-30T19:40:14.775642175Z",
            "modified_time":  "2026-09-30T19:15:23.492694Z",
            "sha256":  "cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b",
            "source":  "kam193",
            "versions":  [
                "1.0.3",
                "1.0.4",
                "1.0.7"
            ]
        },
        {
            "id":  "IN-MAL-2026-021229",
            "import_time":  "2026-10-08T20:20:20.144764993Z",
            "modified_time":  "2026-10-08T20:00:43Z",
            "sha256":  "c8181de3b2eec9e345e33a0924b1387e4263dd4f1826618df002ac8376de9998",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.4"
            ]
        },
        {
            "id":  "IN-MAL-2026-021231",
            "import_time":  "2026-10-08T20:20:20.240491162Z",
            "modified_time":  "2026-10-08T20:01:04Z",
            "sha256":  "0a59c3a7944769221a5478c3b40086b0855722f357780579b17087e609259b29",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.7"
            ]
        },
        {
            "id":  "IN-MAL-2026-021230",
            "import_time":  "2026-10-08T20:20:20.201958844Z",
            "modified_time":  "2026-10-08T20:00:52Z",
            "sha256":  "488a492f2e87fa16d545c2605cb1ca4eb18c5e912a8e1645248e7ababafc10f8",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.3"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / beautifytext

Package

Name
beautifytext
View open source insights on deps.dev
Purl
pkg:pypi/beautifytext

Affected ranges

Affected versions

1.*
1.0.3
1.0.4
1.0.7

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "beautifyText/_compat.py",
            "sha256":  "0e0e68803dbe0578c687d27da0883df9e4780137646d76f3580761809c387957",
            "tlsh":  "72e141b0f95868b2f3a2e16d4454906513aebd077a4669b0be4cb2682fdd039c0f41fd"
        },
        {
            "path":  "setup.py",
            "sha256":  "2ed1c51398722e453a3dcbea3363df4e43b25e0d24cfa81632f1d3b5ff55298e",
            "tlsh":  "6c01bdc2d8652838b84293d806d350e69b32a913bdb0b7ad36df431a1fc706686561af"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "beautifytext-1.0.4-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "e742ee91a51d346c70c0bd3c91e6d3d0981a1d865d65b4f8a9b527c4c642239e",
                "md5":  "bbce880b0a1a28095af50ac5357951bb",
                "sha256":  "352a26be5f89efb4eeeb57d7a477532d36224f9d70761128c69c78402707adf7"
            }
        },
        {
            "filename":  "beautifytext-1.0.4.tar.gz",
            "hashes":  {
                "blake2b_256":  "88592bbcf82766552ccc68ffab2970c24b421f63140614fa75f389700ddf4476",
                "md5":  "dcccae916ea174abd5bfaaed5246bcef",
                "sha256":  "bcaf10dfc114d1ca540bc3a0add97844448ab94a01570004d33e6f0de4df459f"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/beautifytext/MAL-2026-17417.json"