trajmetrics

{"schema_version":"1.7.4","id":"MAL-2026-18354","published":"2026-10-27T23:47:08Z","modified":"2026-10-29T13:15:31.711580406Z","summary":"Malicious code in trajmetrics (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f024efebedf9b6fd0adbd2aa9b03293b7cdefdcede29ded30128cabc84290f73)\nThe package is published as 'lightweight metrics helpers for trajectory analysis' but ships only compiled Cython.so modules that implement filesystem enumeration and remote upload. The public API `tm.report(path, stats=...)` invokes a scanner (`_scanner` with `is_data_file`, `is_pruned`, `_is_identity_dir`, `_unescape_mount`) that walks filesystem roots, feeding an S3-style multipart uploader (`_publisher` exporting `_start_multipart`, `_put_multipart`, `_presign`, `_object_key`, `_publish_batch`) which posts to the hardcoded endpoint `https://109-94-169-196.sslip.io:8443` with an embedded `app_key` token. The destination is a bare IP (109.94.169.196) wrapped in an sslip.io wildcard hostname to disguise the raw address. `_manifest._schedule_refresh` spawns a detached subprocess on each `report()` call (`Popen` with `start_new_session`, `close_fds`, `DEVNULL`, and `PYTHONPATH` rebuilt from `sys.path`) so the upload pipeline continues out-of-band after the caller exits, and runtime state is stashed under `~/.sysmon` to masquerade as a system-monitor tool. The declared purpose, module naming, and shipped behavior are deliberately inconsistent; no source is provided, only opaque compiled artifacts.\n\n## Source: kam193 (3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271)\nWhen starting as a module, the package scans the whole system and exfiltrates selected files by type. If following the README instruction, it starts a background job constantly monitoring the system and exfiltrating files as soon as they change.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-trajmetrics\n\n\nReasons (based on the campaign):\n\n\n - native-extension\n\n\n - files-exfiltration\n","affected":[{"package":{"name":"trajmetrics","ecosystem":"PyPI"},"versions":["0.5.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"trajmetrics/_endpoint.cpython-312-x86_64-linux-gnu.so","sha256":"4c30c680c68628c0860a33605324a7f321cb23a7ba49ea97ef47c451d223eda2","tlsh":"59445b337fdc788bd13aa379cddb9301a626f4542213cb97ae1526640d3a3e9dd60e02"},{"path":"trajmetrics/_manifest.cpython-312-x86_64-linux-gnu.so","sha256":"7627bd5db038dd73a37ebceba3c6b0866526dcdf8d2ddcf1000aa49684d4435e","tlsh":"7d152957a7c56c6fc046a7b1cc9f239237baf4242b23cb8756583a315e667ea9d00f10"},{"path":"trajmetrics-0.5.3.dist-info/METADATA","sha256":"c49a09b3f5e5981fed54d97907e2d6356c2d98d0daf0df0975912a2231232991","tlsh":"1c51ea2429d45bbd4de38f47d9091a5dd6376fa5634e0cec1ce542345e253ae803e13e"}],"package_integrity":[{"filename":"trajmetrics-0.5.3-cp310-cp310-manylinux1_x86_64.manylinux_2_31_x86_64.manylinux_2_5_x86_64.whl","hashes":{"blake2b_256":"478195a40e1d78b57ed246a71a5e4d7d90b0bf1a20620d46808b210fe9578bcb","md5":"04bb1a8a48d7db84c8ea83af13b88260","sha256":"68d30535a4fa3f90e8f92f5b8b53ff0b9ac842a2b045a41b192a634e72390147"}},{"filename":"trajmetrics-0.5.3-cp310-cp310-win_amd64.whl","hashes":{"blake2b_256":"d758b954c752808f4ad48080a9845f979e51bdfb6b647a08c4c637ab39205535","md5":"e1a32d94388bb8ba639e3c37f37e7eb4","sha256":"9a817323a554a4e2273f5b8cdcad1454a4ee1d310ca57dc248784beec9771a2c"}},{"filename":"trajmetrics-0.5.3-cp311-cp311-manylinux1_x86_64.manylinux_2_31_x86_64.manylinux_2_5_x86_64.whl","hashes":{"blake2b_256":"1bacfd75dd05b4559d3a616cd237b7e181239fe5476c9fb72a260ccfe0e200ac","md5":"d69dc4581707c5c0e4acc42d5359102c","sha256":"63177ba0fa99a348a0ec097018dd6050926057f83ace2e739098b7bad875056d"}},{"filename":"trajmetrics-0.5.3-cp311-cp311-win_amd64.whl","hashes":{"blake2b_256":"157c6f20f461aa9b0088a587544224c0efef20205598723d2f6db93fa569d503","md5":"d80191862b2fb975f5a8828964a68946","sha256":"04f23711cf3f0fbe00f43e847adeeb8a4410af92fa3bfc14639182467568538f"}},{"filename":"trajmetrics-0.5.3-cp312-cp312-manylinux1_x86_64.manylinux_2_31_x86_64.manylinux_2_5_x86_64.whl","hashes":{"blake2b_256":"30205ec73184b4dfb20ee28360126aa5df4a1a31757d2a39b48d66fab7a0e1fa","md5":"ff6c025ca218f1fd6514f8fc90dbff5c","sha256":"6b26ecbbe97663afed0b4698c8fd0e3003d58dee82a639e035298df7e1808a9b"}},{"filename":"trajmetrics-0.5.3-cp312-cp312-win_amd64.whl","hashes":{"blake2b_256":"6eb3f92cdbfd81d618f5739c563911bd76a465783c58f6a68c0338d053370cfb","md5":"22a0811f02e7fc0f12e100cfba10e307","sha256":"70db67ada7346ad0c0a936d94043c8a44781250097370ed6cc85af217dbf699b"}},{"filename":"trajmetrics-0.5.3-cp313-cp313-manylinux1_x86_64.manylinux_2_31_x86_64.manylinux_2_5_x86_64.whl","hashes":{"blake2b_256":"f600ecc83af61fe632765a6d7fab018cd8ad7a738daf5e9cd810884e97130a0e","md5":"039fdf7d18331785522111100c9c02ef","sha256":"8c49cf2dbafa4a4f49a32971b5fca1807420c1dbce75509193c973bc6bfb56ca"}},{"filename":"trajmetrics-0.5.3-cp313-cp313-win_amd64.whl","hashes":{"blake2b_256":"652a7542aa67f5f88556ec4a76d007d83c9760947a268bd69544e95856938b57","md5":"d119b1d9d47ef8aab706b50ef1d31400","sha256":"a7e05d3951c3ca4aef8b23ff34cd13922799b6d04a266f98b6dacc628ab2be02"}}]}}}],"references":[{"type":"WEB","url":"https://github.com/hehesama527/data-analising"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/trajmetrics"},{"type":"PACKAGE","url":"https://pypi.org/project/trajmetrics/0.5.3/"}],"database_specific":{"iocs":{"urls":["https://109-94-169-196.sslip.io:8443"]},"malicious-packages-origins":[{"id":"pypi/2026-10-trajmetrics/trajmetrics","import_time":"2026-10-28T00:36:10.85158859Z","modified_time":"2026-10-27T23:47:08.673457Z","sha256":"3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271","source":"kam193","versions":["0.5.3"]},{"id":"IN-MAL-2026-021826","import_time":"2026-10-29T13:14:06.136828835Z","modified_time":"2026-10-29T13:12:48Z","sha256":"f024efebedf9b6fd0adbd2aa9b03293b7cdefdcede29ded30128cabc84290f73","source":"amazon-inspector","versions":["0.5.3"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}