Hyperion VS obfuscator

During our further analysis, it was noted that the package was obfuscated using “Hyperion” and specially crafted to target hosts running Windows Operating Systems. Once the package is installed and executed on the victim’s host, it fetches a malicious piece of python code and saves it on the victim machine. Later the package tries to collect sensitive information such as cookies, saved passwords in a browser, saved cookies of gaming applications and steals financial information from crypto wallets. All the discovered data is saved inside 2 files named wppassw.txt and wpcook.txt. The saved data is later exfiltrated through a discord webhook API. Additionally, it also collected victim’s geo location based on the public IP address.

As much as i hate it i have to include it. https://github.com/billythegoat356/Hyperion

You can download it here, or you can obfuscate directly from the website.

I messaged the offending plugin's devs on Discord. The creator of Tweakin says that the trojan detection in his plugin might be related to this issue, LuckPerms staff says that their libraries detections are either false positives or another plugin infecting LP libs and IV dev hasn't responded yet.

Allitori is the easiest shit to deobf Use Superblaubeere27 obf, it is still easy to deobf but easier for skids like you to use https://github.com/superblaubeere27/obfuscator

i personally find https://github.com/superblaubeere27/obfuscator on default settings to work well. alternatively, you can use https://github.com/sim0n/Caesium too.