Critical Malicious Code Vulnerability in caracas4check Package
Summary
MAL-2026-17198: Malicious code in caracas4check (PyPI). Affects caracas4check versions 1.1.1 – 1.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The caracas4check package, available on PyPI, is intended for use in Python environments to facilitate certain functionalities. However, it has been compromised, embedding malicious code that executes upon installation. This vulnerability poses significant risks to users, as it can lead to unauthorized access and execution of harmful payloads on targeted systems.
Vulnerability Detail
The vulnerability originates from the installation process of the caracas4check package, which installs a boot.pth file in the site-packages directory. This file triggers the execution of c4c_boot.py on every Python interpreter startup. The script exploits the '--extra-index-url=' argument to extract sensitive information from the invoking pip or CI process. It hashes the URL values and compares them against a hardcoded allow-list to determine if the payload should be executed. If matched, it decrypts a hex-encoded blob and executes it, potentially leading to severe security breaches. The malicious code is designed to target specific hosts, making it a targeted attack.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
pip uninstall caracas4checkIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the caracas4check package until a complete fix is verified. Additionally, consider using a virtual environment to isolate your Python projects and limit the impact of any malicious packages.
Conclusion
The caracas4check package has been identified as containing malicious code that poses a significant threat to users. It is crucial to update the package to the latest version to mitigate risks. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for caracas4check →
FAQ
The caracas4check package is a Python package available on PyPI, designed for specific functionalities within Python environments.
The vulnerability allows malicious code to execute on your system, potentially leading to unauthorized access and execution of harmful actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed the affected package, immediately update it to the latest version using 'pip install --upgrade caracas4check' to mitigate the risk.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock. It provides real-time insights into potential vulnerabilities.
