Malicious code in beautifytext (PyPI)

beautifytext versions 1.0.3, 1.0.4, and 1.0.7 include a backdoor implemented in the _compat.py module. When the package is imported or installed, it starts a detached background Python process that registers the host with a remote C2 server at https://bleodw.wisp.uno. The process enters a long-poll loop to receive jobs of three types: 'exec' to run arbitrary shell commands, 'pull' to read arbitrary files, and 'push' to write arbitrary files on the infected system. Host metadata is sent to the C2 server on registration, and the process maintains session heartbeats. The C2 URL is base64-encoded in the source to evade detection. The backdoor activates even during pip install via setup.py hooks, ensuring execution without explicit import.

This backdoor allows an attacker to remotely execute arbitrary shell commands, read any files, and write any files on the infected host. This compromises confidentiality, integrity, and availability of the system. The attacker gains persistent remote access and control, enabling data theft, system manipulation, or further malware deployment. Because the backdoor activates on installation and import, users installing or importing this package are at risk of immediate compromise.

No official patch or remediation is indicated in the provided data. Users should immediately uninstall the affected versions (=1.0.3, =1.0.4, =1.0.7) of beautifytext and avoid installing or importing this package. Verify the integrity and source of Python packages before installation. Monitor for any unauthorized processes or network connections to https://bleodw.wisp.uno. Since no fix is confirmed, check vendor advisories or PyPI for updates or removal notices.