MAL-2026-17198 Malicious code in caracas4check (PyPI)

The package installs boot.pth at the site-packages root, causing 'import c4c_boot' to run on every Python interpreter startup on the host after installation, not only at install time. c4c_boot.py walks up to 8 parent processes via /proc/<pid>/stat and reads /proc/<pid>/cmdline to extract '–extra-index-url=' argument values from the invoking pip/CI process. Each recovered URL value is hashed (sha256(value+'gate')) and compared against a hardcoded allow-list _H of target hashes; on match, the URL string is used as an XOR key to decrypt one of two hex-encoded blobs in _B, and if the plaintext begins with 'OK\n' the remainder is passed to exec() with the URL bound as variable T. The plaintext payload is not recoverable without knowing the exact private index URL of the targeted organization. The README documents installation of an internal package named 'python3/caracas4check' from a private GitLab PyPI index via '–extra-index-url', and this public PyPI package of the same name ships only the.pth bootstrap plus the URL-gated decrypt-and-exec loader — the canonical dependency-confusion delivery shape, with anti-analysis obfuscation (URL-derived XOR key, hash-gated detonation) that only fires for the intended victim.

During installation, the code downloads a malicious executable from a remote location. The malicious action is triggered only on specific hosts.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-caracas4check

Reasons (based on the campaign):

• obfuscation

• targetted-attack

• Downloads and executes a remote executable.

• The package overrides the install command in setup.py to execute malicious code during installation.