{"answers":{"affected":"1 open source package ship an affected version, including caracas4check.","exploited":"There is no known exploitation of MAL-2026-17198 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17198 is a malicious package in caracas4check, published on 27 Sep 2026."},"fix_prompt":"MAL-2026-17198 is a malicious package: caracas4check (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17198/ (Markdown: https://insights.sbomify.com/MAL-2026-17198/index.md)","id":"MAL-2026-17198","markdown":"https://insights.sbomify.com/MAL-2026-17198/index.md","name":"MAL-2026-17198","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package installs boot.pth at the site-packages root, causing 'import c4c_boot' to run on every Python interpreter startup on the host after installation, not only at install time. c4c_boot.py walks up to 8 parent processes via /proc/\u003cpid\u003e/stat and reads /proc/\u003cpid\u003e/cmdline to extract '--extra-index-url=' argument values from the invoking pip/CI process. Each recovered URL value is hashed (sha256(value+'gate')) and compared against a hardcoded allow-list _H of target hashes; on match, the URL string is used as an XOR key to decrypt one of two hex-encoded blobs in _B, and if the plaintext begins with 'OK\\n' the remainder is passed to exec() with the URL bound as variable T. The plaintext payload is not recoverable without knowing the exact private index URL of the targeted organization. The README documents installation of an internal package named 'python3/caracas4check' from a private GitLab PyPI index via '--extra-index-url', and this public PyPI package of the same name ships only the.pth bootstrap plus the URL-gated decrypt-and-exec loader — the canonical dependency-confusion delivery shape, with anti-analysis obfuscation (URL-derived XOR key, hash-gated detonation) that only fires for the intended victim.\n\nDuring installation, the code downloads a malicious executable from a remote location. The malicious action is triggered only on specific hosts.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-09-caracas4check\n\nReasons (based on the campaign):\n\n - obfuscation\n\n - targetted-attack\n\n - Downloads and executes a remote executable.\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in caracas4check (PyPI)","id":"MAL-2026-17198","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"caracas4check","purl":"pkg:pypi/caracas4check","source":"MAL-2026-17198"}],"products":null,"published":"2026-09-27","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17198/"}