Skip to main content
MalwarePublished Updated

cas-base (PyPI) · Malicious Code

Affects cas-baseSource GCVE Database

0

Malicious package : remove cas-base and rotate any secrets on hosts that installed it.

Data as of 27 Oct 2026, 00:07 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2025-193014

What to do

Remove cas-base from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
PyPIcas-baseAffected
  • 1.5.2 – 1.7.1
15 affected builds		Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (69eb341218878aebdec66eb5a44391314921fe3c7fb387021d0684bbb91913b3) The package contains code to install remotely stored malware and ensure its persistence. The code is not triggered automatically; it requires a separate trigger. Originally, cas-base was detected in 2025-07 with an unclear payload. Later it got updated to a clearly malicious payload --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-cas-base Reasons (based on the campaign): - Downloads and executes a remote executable. - malware - persistence

References

Community reviews

Loading reviews…