{"id":"MAL-2026-18354","title":"Malicious code in trajmetrics (PyPI)","summary":"Malicious code in trajmetrics (PyPI)","severity":"critical","exploited":true,"vendor":"trajmetrics","product":"trajmetrics","ecosystem":"pip","affected":["trajmetrics"],"published":"2026-10-27","updated":"2026-10-29","sourceUpdated":"2026-10-29T13:30:04.774153291Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18354","references":[{"url":"https://github.com/hehesama527/data-analising"},{"url":"https://bad-packages.kam193.eu/pypi/package/trajmetrics"},{"url":"https://pypi.org/project/trajmetrics/0.5.3/"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-10-28T19:03:08.578Z","slug":"MAL-2026-18354","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f024efebedf9b6fd0adbd2aa9b03293b7cdefdcede29ded30128cabc84290f73)\nThe package is published as 'lightweight metrics helpers for trajectory analysis' but ships only compiled Cython.so modules that implement filesystem enumeration and remote upload. The public API `tm.report(path, stats=...)` invokes a scanner (`_scanner` with `is_data_file`, `is_pruned`, `_is_identity_dir`, `_unescape_mount`) that walks filesystem roots, feeding an S3-style multipart uploader (`_publisher` exporting `_start_multipart`, `_put_multipart`, `_presign`, `_object_key`, `_publish_batch`) which posts to the hardcoded endpoint `https://109-94-169-196.sslip.io:8443` with an embedded `app_key` token. The destination is a bare IP (109.94.169.196) wrapped in an sslip.io wildcard hostname to disguise the raw address. `_manifest._schedule_refresh` spawns a detached subprocess on each `report()` call (`Popen` with `start_new_session`, `close_fds`, `DEVNULL`, and `PYTHONPATH` rebuilt from `sys.path`) so the upload pipeline continues out-of-band after the caller exits, and runtime state is stashed under `~/.sysmon` to masquerade as a system-monitor tool. The declared purpose, module naming, and shipped behavior are deliberately inconsistent; no source is provided, only opaque compiled artifacts.\n\n## Source: kam193 (3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271)\nWhen starting as a module, the package scans the whole system and exfiltrates selected files by type. If following the README instruction, it starts a background job constantly monitoring the system and exfiltrating files as soon as they change.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-trajmetrics\n\n\nReasons (based on the campaign):\n\n\n - native-extension\n\n\n - files-exfiltration\n\n\n## Affected packages\n\n- `trajmetrics`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}