{"id":7067,"library":"cart","title":"CaRT Neutering Format Library","description":"Compressed and RC4 Transport (CaRT) is a file format and an associated Python library used to 'neuter' files for secure distribution, particularly in the malware analysis community. It encrypts and compresses files, optionally embedding metadata, to prevent execution and detection by antivirus software. The library provides functionalities for packing and unpacking CaRT files and currently supports format version 1. It is actively maintained by Cybercentre Canada, with the latest stable release being 1.2.3.","status":"active","version":"1.2.3","language":"python","source_language":"en","source_url":"https://github.com/CybercentreCanada/cart","tags":["security","file-format","malware","encryption","compression","cybersecurity"],"install":[{"cmd":"pip install cart","lang":"bash","label":"Install latest version"}],"dependencies":[],"imports":[{"wrong":"from cart.pack import pack_file","symbol":"pack_file","correct":"from cart import pack_file"},{"symbol":"unpack_file","correct":"from cart import unpack_file"},{"symbol":"cart","correct":"from cart import cart"}],"quickstart":{"code":"import os\nfrom cart.pack import pack_file\nfrom cart.unpack import unpack_file\n\n# Create a dummy file to pack\noriginal_file = 'test_original.txt'\nwith open(original_file, 'w') as f:\n    f.write('This is a test file for CaRT neutering.')\n\n# Pack the file\ncart_file = 'test_original.cart'\npack_file(original_file, cart_file)\nprint(f\"File packed: {original_file} -> {cart_file}\")\n\n# Unpack the file\nunpacked_file = 'test_unpacked.txt'\nunpack_file(cart_file, unpacked_file)\nprint(f\"File unpacked: {cart_file} -> {unpacked_file}\")\n\n# Verify content (optional)\nwith open(unpacked_file, 'r') as f:\n    content = f.read()\n    print(f\"Unpacked content: {content}\")\n\n# Clean up\nos.remove(original_file)\nos.remove(cart_file)\nos.remove(unpacked_file)\n","lang":"python","description":"This example demonstrates how to pack a simple text file into the CaRT format and then unpack it using the synchronous API. The library handles compression and default ARC4 encryption."},"warnings":[{"fix":"Ensure your project runs on Python 3.6 or newer. Upgrade your Python environment if necessary.","message":"Python 2 support has been entirely removed starting from versions 1.2.0 and 1.2.1. Attempting to use `cart` with Python 2 will result in `ImportError` or `SyntaxError`.","severity":"breaking","affected_versions":">=1.2.0"},{"fix":"When unpacking a CaRT file created with a private key, pass the identical key to the `key` argument of `unpack_file` or `unpack_stream` functions. For example: `unpack_file(cart_path, output_path, key=b'your_private_key')`.","message":"The CaRT format uses ARC4 encryption, with a default key (the first 8 digits of Pi, twice) unless explicitly overridden. If a private key is used during packing, the same private key MUST be provided for unpacking, otherwise decryption will fail.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Upgrade to `cart` version 1.2.3 or higher to benefit from the fix that prevents root path possibilities from metadata filenames.","message":"A vulnerability related to path traversal by crafting metadata filenames was addressed in v1.2.3. Older versions might be susceptible if processing untrusted `.cartmeta` files.","severity":"gotcha","affected_versions":"<1.2.3"}],"env_vars":null,"search_vec":"'1':63 '1.2.3':77 'activ':66 'analysi':30 'antivirus':46 'associ':16 'canada':70 'cart':1,9,56 'communiti':31 'compress':5,35,84 'current':59 'cybercentr':69 'cybersecur':85 'detect':44 'distribut':25 'embed':38 'encrypt':33,83 'execut':42 'file':12,22,36,57,80 'file-format':79 'format':3,13,61,81 'function':51 'latest':73 'librari':4,18,49 'maintain':67 'malwar':29,82 'metadata':39 'neuter':2,21 'option':37 'pack':53 'particular':26 'prevent':41 'provid':50 'python':17 'rc4':7 'releas':75 'secur':24,78 'softwar':47 'stabl':74 'support':60 'transport':8 'unpack':55 'use':19 'version':62","created_at":"2026-04-16T13:42:03.276307+00:00","updated_at":"2026-04-16T13:42:03.276307+00:00","problems":null,"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"1.2.3","cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/CybercentreCanada/cart","docs":null,"changelog":null,"pypi":"https://pypi.org/project/cart/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["auth-security","serialization"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-06-30","last_verified":"2026-06-30","next_check":"2026-07-30","install_tag":null}}