Malicious Code Exploit in beautifytext Package: Remote Command Execution Vulnerability
Summary
MAL-2026-17417: Malicious code in beautifytext (PyPI). Affects beautifytext versions 1.0.3 – 1.0.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The beautifytext package, available on PyPI, is designed to enhance text formatting and presentation in Python applications. It is commonly used for beautifying text outputs in various projects. However, version 1.0.3 of beautifytext has been found to contain malicious code that compromises the security of systems using this package.
Vulnerability Detail
The vulnerability originates from beautifytext version 1.0.3, which imports a module that initiates a detached background process upon import. This process registers sensitive information about the host system, including hostname, user, OS, and working directory, with a remote server (https://bleodw.wisp.uno). It then polls this server for commands to execute, allowing remote attackers to run shell commands and manipulate files on the victim's machine. This poses a significant risk as it can lead to unauthorized access and control over the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall beautifytextIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the beautifytext package from your environment until a secure version is confirmed. Use the command: pip uninstall beautifytext.
Conclusion
The beautifytext package has a critical vulnerability that allows remote command execution due to malicious code present in certain versions. Users are strongly advised to update to a secure version or remove the package to protect their systems from potential exploitation.
See every vulnerability recorded for beautifytext →
FAQ
Beautifytext is a Python package used for enhancing text formatting and presentation in applications.
Versions 1.0.3 and 1.0.4 of beautifytext are affected by the malicious code vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package, consider uninstalling beautifytext as a temporary measure to mitigate the risk.
The vulnerability was reported by Kamil Mańkowski (kam193) and discovered by smiling-hyena.
