Malicious code in caracas4check (PyPI)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (973d711f03dafa9f390e489476d4795acdda8db926bdd688ca5e1abbe6efa025) The package installs boot.pth at the site-packages root, causing 'import c4c_boot' to run on every Python interpreter startup on the host after installation, not only at install time. c4c_boot.py walks up to 8 parent processes via /proc//stat and reads /proc//cmdline to extract '--extra-index-url=' argument values from the invoking pip/CI process. Each recovered URL value is hashed (sha256(value+'gate')) and compared against a hardcoded allow-list _H of target hashes; on match, the URL string is used as an XOR key to decrypt one of two hex-encoded blobs in _B, and if the plaintext begins with 'OK\n' the remainder is passed to exec() with the URL bound as variable T. The plaintext payload is not recoverable without knowing the exact private index URL of the targeted organization. The README documents installation of an internal package named 'python3/caracas4check' from a private GitLab PyPI index via '--extra-index-url', and this public PyPI package of the same name ships only the.pth bootstrap plus the URL-gated decrypt-and-exec loader — the canonical dependency-confusion delivery shape, with anti-analysis obfuscation (URL-derived XOR key, hash-gated detonation) that only fires for the intended victim. ## Source: kam193 (fe298eb267ef99191242315438fe8b7a619bece89e39d3e607cc34af455c647a) During installation, the code downloa
MAL-2026-17198
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17198
caracas4check
Source reference: /affected/0/package/name
- Affected versions
- 1.1.1
Source reference:
/affected/0/versions1.1.2Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "caracas4check",
"purl": "pkg:pypi/caracas4check",
"ecosystem": "PyPI"
},
"versions": [
"1.1.1",
"1.1.2"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/caracas4check/MAL-2026-17198.json",
"indicators": {
"evidence_files": [
{
"path": "c4c_boot.py",
"tlsh": "eb519574ac9a2ce3e647899d493ad45023667e236213a03a7fdc61941fd01f2c3b959a",
"sha256": "2e251f21f67e0ecebff8a4fb48458149dcffe45c975c313ac1f936f9fe693fd2"
},
{
"path": "caracas4check-1.1.1.dist-info/METADATA",
"tlsh": "a4a1b77553d1537392ea1be1ba5d5291e723d03c33262ca57dcc4254478a2e2877f0eb",
"sha256": "e264d04123fa94cad0d9ed4089d6f8ea97c7db9975ce1d8195a82f6da624bebd"
}
],
"package_integrity": [
{
"hashes": {
"md5": "1657ce6cf8185af9cba09eb605d42f1a",
"sha256": "85f434209d1aefabf3807363909d8a8918a36acddcbf55a5b3cb415b40ea9ab0",
"blake2b_256": "77a41dd50d83b29a1f863fd58312c5b26f431848d23335f221f09ef867d44b41"
},
"filename": "caracas4check-1.1.1-py3-none-any.whl"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #19726 · Revision 1
- Added to Heist Feed
- Publisher date