caracas4check

Details

**Severity:** Critical

**Affected versions:** `= 1.1.1`

## Source: kam193 (fe298eb267ef99191242315438fe8b7a619bece89e39d3e607cc34af455c647a)
During installation, the code downloads a malicious executable from a remote location. The malicious action is triggered only on specific hosts.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-caracas4check


Reasons (based on the campaign):


 - obfuscation


 - targetted-attack


 - Downloads and executes a remote executable.


 - The package overrides the install command in setup.py to execute malicious code during installation.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e383a12e3795567579498010f08204ab193c9217/osv/malicious/pypi/caracas4check/MAL-2026-17198.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/caracas4check
- https://github.com/ossf/malicious-packages/blob/e383a12e3795567579498010f08204ab193c9217/osv/malicious/pypi/caracas4check/MAL-2026-17198.json
- https://www.virustotal.com/gui/file/296b5205b6a5c48ab5dcdbf4abf34818991f1202e560137ee480c075135f63ec/detection
- https://github.com/ossf/malicious-packages/blob/8cc19dcd9afa4cab2621a91bf3ed70e4b2c14a5c/osv/malicious/pypi/caracas4check/MAL-2026-17198.json
- https://pypi.org/project/caracas4check/1.1.1
- https://pypi.org/project/caracas4check/1.1.2
- https://github.com/advisories/GHSA-8p46-j5h8-w78j

Compromised versions (1)

• = 1.1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.