cas-base

Details

**Severity:** Critical

**Affected versions:** `= 1.5.2`

## Source: kam193 (69eb341218878aebdec66eb5a44391314921fe3c7fb387021d0684bbb91913b3)
The package contains code to install remotely stored malware and ensure its persistence. The code is not triggered automatically; it requires a separate trigger.

Originally, cas-base was detected in 2025-07 with an unclear payload. Later it got updated to a clearly malicious payload


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2025-07-cas-base


Reasons (based on the campaign):


 - Downloads and executes a remote executable.


 - malware


 - persistence

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/cas-base/MAL-2025-193014.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/cas-base
- https://github.com/kamakshyatest4/python-malware/blob/45f86d614fd5c8c01d844a458d56c292c7c060c2/requirements.txt#L1
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/cas-base/MAL-2025-193014.json
- https://tria.ge/250712-jwamlsyxat
- https://www.virustotal.com/gui/file/0338390d7b545f2695622df543b67b9a87131416b71dfb368a874a335a55238f/detection
- https://www.virustotal.com/gui/file/20377b8ee72f1371ed41228f47d4bce20b1b3c89b8465626fb78bc3f18ea935e/detection
- https://www.virustotal.com/gui/file/40b64916c5a38fde2b9939c674a2eaefd39df6216014e35a86b596746d34e2e9
- https://www.virustotal.com/gui/file/94b4fd98f0f168d999753bed16817ba15b0f17e7373819e3c383feac9dac58c1/detection

Compromised versions (1)

• = 1.5.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.