---
id: MAL-2026-18354
title: Malicious code in trajmetrics (PyPI)
summary: Malicious code in trajmetrics (PyPI)
severity: critical
exploited: true
vendor: trajmetrics
product: trajmetrics
ecosystem: pip
affected:
  - trajmetrics
published: '2026-10-27'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T13:30:04.774153291Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-18354'
references:
  - url: 'https://github.com/hehesama527/data-analising'
  - url: 'https://bad-packages.kam193.eu/pypi/package/trajmetrics'
  - url: 'https://pypi.org/project/trajmetrics/0.5.3/'
tags:
  - osv
  - pip
  - malware
ingestedAt: '2026-10-28T19:03:08.578Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f024efebedf9b6fd0adbd2aa9b03293b7cdefdcede29ded30128cabc84290f73)
The package is published as 'lightweight metrics helpers for trajectory analysis' but ships only compiled Cython.so modules that implement filesystem enumeration and remote upload. The public API `tm.report(path, stats=...)` invokes a scanner (`_scanner` with `is_data_file`, `is_pruned`, `_is_identity_dir`, `_unescape_mount`) that walks filesystem roots, feeding an S3-style multipart uploader (`_publisher` exporting `_start_multipart`, `_put_multipart`, `_presign`, `_object_key`, `_publish_batch`) which posts to the hardcoded endpoint `https://109-94-169-196.sslip.io:8443` with an embedded `app_key` token. The destination is a bare IP (109.94.169.196) wrapped in an sslip.io wildcard hostname to disguise the raw address. `_manifest._schedule_refresh` spawns a detached subprocess on each `report()` call (`Popen` with `start_new_session`, `close_fds`, `DEVNULL`, and `PYTHONPATH` rebuilt from `sys.path`) so the upload pipeline continues out-of-band after the caller exits, and runtime state is stashed under `~/.sysmon` to masquerade as a system-monitor tool. The declared purpose, module naming, and shipped behavior are deliberately inconsistent; no source is provided, only opaque compiled artifacts.

## Source: kam193 (3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271)
When starting as a module, the package scans the whole system and exfiltrates selected files by type. If following the README instruction, it starts a background job constantly monitoring the system and exfiltrating files as soon as they change.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-trajmetrics


Reasons (based on the campaign):


 - native-extension


 - files-exfiltration


## Affected packages

- `trajmetrics`

## Remediation

Refer to the advisory for the patched release.