MAL-2026-18354 Malicious code in trajmetrics (PyPI)

The package is published as 'lightweight metrics helpers for trajectory analysis' but ships only compiled Cython.so modules that implement filesystem enumeration and remote upload. The public API tm.report(path, stats=...) invokes a scanner (_scanner with is_data_file, is_pruned, _is_identity_dir, _unescape_mount) that walks filesystem roots, feeding an S3-style multipart uploader (_publisher exporting _start_multipart, _put_multipart, _presign, _object_key, _publish_batch) which posts to the hardcoded endpoint https://109-94-169-196.sslip.io:8443 with an embedded app_key token. The destination is a bare IP (109.94.169.196) wrapped in an sslip.io wildcard hostname to disguise the raw address. _manifest._schedule_refresh spawns a detached subprocess on each report() call (Popen with start_new_session, close_fds, DEVNULL, and PYTHONPATH rebuilt from sys.path) so the upload pipeline continues out-of-band after the caller exits, and runtime state is stashed under ~/.sysmon to masquerade as a system-monitor tool. The declared purpose, module naming, and shipped behavior are deliberately inconsistent; no source is provided, only opaque compiled artifacts.

When starting as a module, the package scans the whole system and exfiltrates selected files by type. If following the README instruction, it starts a background job constantly monitoring the system and exfiltrating files as soon as they change.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-trajmetrics

Reasons (based on the campaign):

• native-extension

• files-exfiltration