{"id":"MAL-2026-17193","kind":"package","aliases":["MAL-2026-17193"],"related":[],"title":"Malicious code in metrio (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ce8ee66a844d7abed74f4b9d223c8ef8f35bae380104526f4f8bc57295c47320)\nmetrio 999.0.0 executes a hostname-exfiltration beacon from both setup.py (install time) and metrio/__init__.py (import time). The code reads the local machine's hostname, hex-encodes it, and embeds it as a subdomain of the attacker-controlled domain 84avt3516s4q1obsv9q0mh4u2l8dw3ks.x9.to, then triggers a DNS resolution via socket.gethostbyname and a plain-HTTP GET via urllib.request.urlopen against that host. The version number 999.0.0 and the self-described 'dependency-confusion PoC placeholder' summary are the canonical high-version dependency-confusion shape: the package is intended to win resolution against an internal package of the same name and beacon the resolving host back to the operator. Installer harm on `pip install metrio` or `import metrio` is disclosure of the installer's hostname to a third-party collector, and confirmation to the operator that this internal name resolves to the public index from the installer's build environment.\n\n## Source: kam193 (f7b0289ef68f815e0fd296282739990dfc918c0070fb5acdae2787ca8eba23f3)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"metrio","fixed":[],"affected":"= 999.0.0; = 1000.0.0; = 1001.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-27T07:06:20+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:08:21+00:00","updated_at":"2026-10-26T21:08:21+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-17193':8A,11A '-2026':7A,10A '84avt3516s4q1obsv9q0mh4u2l8dw3ks.x9.to':70C '999.0.0':30C,92C 'also':213C 'amazon':26C 'amazon-inspector':25C 'anyth':214C 'attack':67C 'attacker-control':66C 'back':134C 'base':240C 'basic':191C,250C 'beacon':36C,130C 'build':178C 'campaign':232C,243C 'canon':106C 'categori':203C 'ce8ee66a844d7abed74f4b9d223c8ef8f35bae380104526f4f8bc57295c47320':28C 'clear':227C 'co':225C 'code':2A,47C,247C,275C 'collector':159C 'command':269C 'confirm':161C 'confus':100C,112C 'contain':246C 'control':68C 'data':251C 'depend':99C,111C 'dependency-confus':98C,110C 'describ':97C 'detail':17C 'disclosur':148C 'dns':74C 'domain':69C 'edit':20C 'emb':59C 'encod':56C 'environ':179C 'execut':31C,273C 'exfiltr':35C,190C,249C 'explor':219C 'f7b0289ef68f815e0fd296282739990dfc918c0070fb5acdae2787ca8eba23f3':182C 'generic':234C 'generic-standard-pypi-install-pentest':233C 'get':83C 'harm':139C,230C 'hex':55C 'hex-encod':54C 'high':108C 'high-vers':107C 'host':88C,133C,195C 'hostnam':34C,53C,153C 'hostname-exfiltr':33C 'http':82C 'import':44C,145C,187C 'index':173C 'inform':192C 'inspector':27C 'instal':40C,138C,142C,151C,176C,183C,237C,268C,277C 'intend':117C 'intern':123C,167C 'ip':256C 'kam193':181C 'kit':223C 'like':208C,217C,255C 'limit':262C 'line':23C 'local':50C 'look':207C,216C 'low':229C 'low-harm':228C 'machin':51C 'mal':6A,9A 'malici':1A,13B,274C 'metrio':4A,12A,29C,143C,146C 'metrio/__init__.py':43C 'modul':189C 'name':128C,168C 'number':91C 'oper':137C,164C 'overrid':266C 'packag':14B,115C,124C,185C,198C,206C,211C,245C,265C 'parti':158C 'pentest':205C,210C,238C 'per':15C 'pip':141C 'placehold':102C 'plain':81C 'plain-http':80C 'poc':101C 'possibl':231C 'pre':221C 'pre-prepar':220C 'prepar':222C 'probabl':204C 'public':172C 'purpos':202C 'pypi':5A,236C 'read':48C 'reason':239C 'research':224C 'resolut':75C,120C 'resolv':132C,169C 'risk':263C 'self':96C 'self-describ':95C 'setup.py':39C,271C 'shape':113C 'socket.gethostbyname':77C 'sourc':16C,24C,180C 'standard':235C 'subdomain':63C 'summari':103C 'system':254C 'test':218C 'third':157C 'third-parti':156C 'time':41C,45C 'trigger':72C 'typic':209C 'urllib.request.urlopen':85C 'usernam':258C 'version':90C,109C 'via':76C,84C 'win':119C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-27T07:06:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17193","url":"https://osv.dev/vulnerability/MAL-2026-17193","severity":"critical","published_at":"2026-09-27T07:06:20+00:00","modified_at":"2026-09-30T01:45:10+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}