Suspicious 80% python Download

caracas4check 1.1.1

Hidden .pth payload executes obfuscated code

“Human-oriented Python client for the 4check caracas API”

Source references XOR syntaxFile is a Python path configuration
SHA-25685f434209d1aefabf3807363909d8a8918a36acddcbf55a5b3cb415b40ea9ab0
URLhttps://files.pythonhosted.org/packages/77/a4/1dd50d83b29a1f863fd58312c5b26f431848d23335f221f09ef867d44b41/caracas4check-1.1.1-py3-none-any.whl
MaleculeO₅(CCaLaP₂S₂)H₇(Cm₁₃Cr₂Db₇F₂OsPo₂Ti)Md₅(BkIn₅Pa₃Pt)

Also flagged by osv (MAL-2026-17198: Malicious code in caracas4check (PyPI)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.