MAL-2026-18354: Malicious code in trajmetrics (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (f024efebedf9b6fd0adbd2aa9b03293b7cdefdcede29ded30128cabc84290f73) The package is published as 'lightweight metrics helpers for trajectory analysis' but ships only compiled Cython.so modules that implement filesystem enumeration and remote upload. The public API tm.report(path, stats=...) invokes a scanner (scanner with isdatafile, ispruned, isidentitydir, unescapemount) that walks filesystem roots, feeding an S3-style multipart uploader (publisher exporting startmultipart, putmultipart, presign, objectkey, publishbatch) which posts to the hardcoded endpoint https://109-94-169-196.sslip.io:8443 with an embedded appkey token. The destination is a bare IP (109.94.169.196) wrapped in an sslip.io wildcard hostname to disguise the raw address. manifest.schedulerefresh spawns a detached subprocess on each report() call (Popen with startnewsession, closefds, DEVNULL, and PYTHONPATH rebuilt from sys.path) so the upload pipeline continues out-of-band after the caller exits, and runtime state is stashed under ~/.sysmon to masquerade as a system-monitor tool. The declared purpose, module naming, and shipped behavior are deliberately inconsistent; no source is provided, only opaque compiled artifacts.
Source: kam193 (3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271) When starting as a module, the package scans the whole system and exfiltrates selected files by type. If following the README instruction, it starts a background job constantly monitoring the system and exfiltrating files as soon as they change.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-trajmetrics
Reasons (based on the campaign):
- native-extension
- files-exfiltration