macOS.Gaslight curl download of astral-sh cpython standalone runtime for stealer

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

This rule detects the download of a standalone Python build for Apple Darwin from astral-sh/python-build-standalone on GitHub using 'curl', followed by its extraction using 'tar'. This activity could indicate a developer setting up a specific Python environment or potentially a malicious actor introducing a custom Python interpreter.