Registry / auth-security / cart
library1.2.3pypypi✓ verified 87d ago

Compressed and RC4 Transport (CaRT) is a file format and an associated Python library used to 'neuter' files for secure distribution, particularly in the malware analysis community. It encrypts and compresses files, optionally embedding metadata, to prevent execution and detection by antivirus software. The library provides functionalities for packing and unpacking CaRT files and currently supports format version 1. It is actively maintained by Cybercentre Canada, with the latest stable release being 1.2.3.

pip install cart
INSTALL
IMPORT
SIG · CART
C
cart
auth-securitypythonv1.2.3
Install
2.1s avg
Import
—
Disk
25MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.9–3.13
musl
3.9–3.13
Install & Compatibility
Where this runs
tested against v1.2.3 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.10–3.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 26.4MB
glibc
py 3.10–3.920 runs
installs and imports cleanly · install 2.1s · import 0.000s · 27MB
25MB installed
● package 25MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

pack_file
✓ from cart import pack_file
✗ from cart.pack import pack_file
unpack_file
✓ from cart import unpack_file
cart
✓ from cart import cart

This example demonstrates how to pack a simple text file into the CaRT format and then unpack it using the synchronous API. The library handles compression and default ARC4 encryption.

import os from cart.pack import pack_file from cart.unpack import unpack_file # Create a dummy file to pack original_file = 'test_original.txt' with open(original_file, 'w') as f: f.write('This is a test file for CaRT neutering.') # Pack the file cart_file = 'test_original.cart' pack_file(original_file, cart_file) print(f"File packed: {original_file} -> {cart_file}") # Unpack the file unpacked_file = 'test_unpacked.txt' unpack_file(cart_file, unpacked_file) print(f"File unpacked: {cart_file} -> {unpacked_file}") # Verify content (optional) with open(unpacked_file, 'r') as f: content = f.read() print(f"Unpacked content: {content}") # Clean up os.remove(original_file) os.remove(cart_file) os.remove(unpacked_file)
Debug
Known issues
breakingPython 2 support has been entirely removed starting from versions 1.2.0 and 1.2.1. Attempting to use `cart` with Python 2 will result in `ImportError` or `SyntaxError`.
fix
Ensure your project runs on Python 3.6 or newer. Upgrade your Python environment if necessary.
affects: >=1.2.0
gotchaThe CaRT format uses ARC4 encryption, with a default key (the first 8 digits of Pi, twice) unless explicitly overridden. If a private key is used during packing, the same private key MUST be provided for unpacking, otherwise decryption will fail.
fix
When unpacking a CaRT file created with a private key, pass the identical key to the `key` argument of `unpack_file` or `unpack_stream` functions. For example: `unpack_file(cart_path, output_path, key=b'your_private_key')`.
affects: All versions
gotchaA vulnerability related to path traversal by crafting metadata filenames was addressed in v1.2.3. Older versions might be susceptible if processing untrusted `.cartmeta` files.
fix
Upgrade to `cart` version 1.2.3 or higher to benefit from the fix that prevents root path possibilities from metadata filenames.
affects: <1.2.3
Upgrade
Version history
1.2.3latest on PyPI · released Feb 10, 2025
Audit
Dependencies

No dependency data recorded yet.

Agent activity
32 hits · last 30 days
node
28
OpenAI (training)
1
Resources
cart — pip install cart · libregistry