{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "c4c_boot.py",
              "sha256": "2e251f21f67e0ecebff8a4fb48458149dcffe45c975c313ac1f936f9fe693fd2",
              "tlsh": "eb519574ac9a2ce3e647899d493ad45023667e236213a03a7fdc61941fd01f2c3b959a"
            },
            {
              "path": "caracas4check-1.1.1.dist-info/METADATA",
              "sha256": "e264d04123fa94cad0d9ed4089d6f8ea97c7db9975ce1d8195a82f6da624bebd",
              "tlsh": "a4a1b77553d1537392ea1be1ba5d5291e723d03c33262ca57dcc4254478a2e2877f0eb"
            }
          ],
          "package_integrity": [
            {
              "filename": "caracas4check-1.1.1-py3-none-any.whl",
              "hashes": {
                "blake2b_256": "77a41dd50d83b29a1f863fd58312c5b26f431848d23335f221f09ef867d44b41",
                "md5": "1657ce6cf8185af9cba09eb605d42f1a",
                "sha256": "85f434209d1aefabf3807363909d8a8918a36acddcbf55a5b3cb415b40ea9ab0"
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "caracas4check"
      },
      "versions": [
        "1.1.1",
        "1.1.2"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Ma\u0144kowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "iocs": {
      "ips": [
        "185.241.208.139"
      ],
      "urls": [
        "https://185.241.208.139/fbe1286357a09e81b12243baad454c0b544c6cf3c4d6245e56e13581b4b33709/x"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "pypi/2026-09-caracas4check/caracas4check",
        "import_time": "2026-09-27T11:15:40.441755029Z",
        "modified_time": "2026-09-27T10:50:14.229499Z",
        "sha256": "fe298eb267ef99191242315438fe8b7a619bece89e39d3e607cc34af455c647a",
        "source": "kam193",
        "versions": [
          "1.1.1",
          "1.1.2"
        ]
      },
      {
        "id": "IN-MAL-2026-020568",
        "import_time": "2026-09-27T14:16:28.272580963Z",
        "modified_time": "2026-09-27T13:44:02Z",
        "sha256": "973d711f03dafa9f390e489476d4795acdda8db926bdd688ca5e1abbe6efa025",
        "source": "amazon-inspector",
        "versions": [
          "1.1.1"
        ]
      },
      {
        "id": "IN-MAL-2026-020567",
        "import_time": "2026-09-27T14:16:28.170700742Z",
        "modified_time": "2026-09-27T13:43:52Z",
        "sha256": "d4e20377146c9380ef7e3232f966f33507c41e79471fbda3b514c571e35145d1",
        "source": "amazon-inspector",
        "versions": [
          "1.1.2"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (973d711f03dafa9f390e489476d4795acdda8db926bdd688ca5e1abbe6efa025)\nThe package installs boot.pth at the site-packages root, causing \u0027import c4c_boot\u0027 to run on every Python interpreter startup on the host after installation, not only at install time. c4c_boot.py walks up to 8 parent processes via /proc/\u003cpid\u003e/stat and reads /proc/\u003cpid\u003e/cmdline to extract \u0027--extra-index-url=\u0027 argument values from the invoking pip/CI process. Each recovered URL value is hashed (sha256(value+\u0027gate\u0027)) and compared against a hardcoded allow-list _H of target hashes; on match, the URL string is used as an XOR key to decrypt one of two hex-encoded blobs in _B, and if the plaintext begins with \u0027OK\\n\u0027 the remainder is passed to exec() with the URL bound as variable T. The plaintext payload is not recoverable without knowing the exact private index URL of the targeted organization. The README documents installation of an internal package named \u0027python3/caracas4check\u0027 from a private GitLab PyPI index via \u0027--extra-index-url\u0027, and this public PyPI package of the same name ships only the.pth bootstrap plus the URL-gated decrypt-and-exec loader \u2014 the canonical dependency-confusion delivery shape, with anti-analysis obfuscation (URL-derived XOR key, hash-gated detonation) that only fires for the intended victim.\n\n## Source: kam193 (fe298eb267ef99191242315438fe8b7a619bece89e39d3e607cc34af455c647a)\nDuring installation, the code downloads a malicious executable from a remote location. The malicious action is triggered only on specific hosts.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-caracas4check\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - targetted-attack\n\n\n - Downloads and executes a remote executable.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n",
  "id": "MAL-2026-17198",
  "modified": "2026-09-27T14:18:07.880765359Z",
  "published": "2026-09-27T10:50:14Z",
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://www.virustotal.com/gui/file/296b5205b6a5c48ab5dcdbf4abf34818991f1202e560137ee480c075135f63ec/detection"
    },
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/caracas4check"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/caracas4check/1.1.1/"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/caracas4check/1.1.2/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in caracas4check (PyPI)"
}