MAL-2026-18354

Dashboard / Malicious Package / MAL-2026-18354

MAL-2026-18354

Summary: Malicious code in trajmetrics (PyPI)

Details: Source: amazon-inspector (f024efebedf9b6fd0adbd2aa9b03293b7cdefdcede29ded30128cabc84290f73) The package is published as 'lightweight metrics helpers for trajectory analysis' but ships only compiled Cython.so modules that implement filesystem enumeration and remote upload. The public API `tm.report(path, stats=...)` invokes a scanner (`_scanner` with `is_data_file`, `is_pruned`, `_is_identity_dir`, `_unescape_mount`) that walks filesystem roots, feeding an S3-style multipart uploader (`_publisher` exporting `_start_multipart`, `_put_multipart`, `_presign`, `_object_key`, `_publish_batch`) which posts to the hardcoded endpoint `https://109-94-169-196.sslip.io:8443` with an embedded `app_key` token. The destination is a bare IP (109.94.169.196) wrapped in an sslip.io wildcard hostname to disguise the raw address. `_manifest._schedule_refresh` spawns a detached subprocess on each `report()` call (`Popen` with `start_new_session`, `close_fds`, `DEVNULL`, and `PYTHONPATH` rebuilt from `sys.path`) so the upload pipeline continues out-of-band after the caller exits, and runtime state is stashed under `~/.sysmon` to masquerade as a system-monitor tool. The declared purpose, module naming, and shipped behavior are deliberately inconsistent; no source is provided, only opaque compiled artifacts. Source: kam193 (3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271) When starting as a module, the package scans the whole system and exfiltrates selected files by type. If following the README instruction, it starts a background job constantly monitoring the system and exfiltrating files as soon as they change. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-trajmetrics Reasons (based on the campaign): - native-extension - files-exfiltration

References: https://github.com/hehesama527/data-analising, https://bad-packages.kam193.eu/pypi/package/trajmetrics, https://pypi.org/project/trajmetrics/0.5.3/