---
id: cart
version: "1.2.3"
license: MIT
license_treatment: permissive
maintenance: dormant
---

# cart — CaRT Neutering format

License: permissive · Maintenance: dormant · Downloads: 360.9K/mo

## What it is and what it does

CaRT is a specialized file format designed to safely store and transfer malware samples by compressing them with zlib, encrypting them with RC4, and embedding associated metadata—including optional STIX v2 threat intelligence reports—all within a single .cart file. The format includes a mandatory header and footer structure that allows metadata and hash information to be read without decompressing the entire payload, and it uses a default RC4 key (first 8 digits of pi, twice) unless overridden with a custom key.

The package provides both a Python library for programmatic access and a command-line interface that automatically detects whether to encode or decode a file. It reads optional metadata from .cartmeta files with matching prefixes and supports configuration via ~/.cart/cart.cfg. The primary use case is in malware analysis and threat intelligence workflows where samples must be safely archived and shared without triggering antivirus detection or accidental execution.

Use it for:

- Archive malware samples for security research with embedded STIX v2 threat reports without triggering antivirus alerts
- Transfer suspected malware between security teams with metadata and hash verification built into the file structure
- Store malware collections with streaming compression to reduce storage footprint while preserving metadata accessibility
- Integrate threat intelligence reports directly into malware samples for downstream analysis tools via STIX v2 JSON embedding
- Read file hashes and metadata from archived samples without decompressing the full payload for rapid triage

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

CaRT is a file format and Python library for compressing, encrypting, and storing malware samples alongside metadata using RC4 and zlib, with optional STIX v2 integration.

Yes, if you work in malware analysis, threat intelligence, or security research and need a standardized format for safe malware storage and transfer with embedded metadata. The low install friction, permissive license, and lack of known vulnerabilities make it a safe choice. However, note that maintenance is dormant and RC4 is cryptographically weak by modern standards—verify that RC4 meets your security requirements before adopting for new systems rather than legacy workflows.

## Install

pip install cart
uv add cart
poetry add cart

## Installing cart

Before you install: Low install friction with a single runtime dependency (pycryptodome). Maintenance is dormant—last commit was 2025-02-10 but no releases for 550 days prior, suggesting the package is stable but not actively developed.

License in practice: MIT license (permissive) places no restrictions on use, modification, or redistribution in proprietary or open-source contexts.

Quickstart:

pip install cart

from cart import CaRT

# Encode a file with optional metadata
cart = CaRT()
cart.encode('malware.exe', 'malware.exe.cartmeta')

# Decode a CaRT file
cart.decode('malware.exe.cart')

Requires pycryptodome for RC4 encryption; Python 3.6 or later.

Verify before relying:

- Whether RC4 encryption meets current security standards for new deployments versus legacy/archival use only
- Performance characteristics and streaming efficiency claims relative to standard compression tools
- Compatibility with STIX v2 implementations beyond the JSON embedding example shown

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: dormant
- Downloads: 360.9K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

malware storage format, encrypted file compression, RC4 zlib transport, malware metadata embedding, STIX report packaging, secure file neutering, cryptographic file archive, malware-analysis, threat-intelligence, stix-integration

[View on SkillFed](https://skillfed.io/packages/cart) · [View on PyPI](https://pypi.org/project/cart/)