{"id":"MAL-2026-18354","kind":"package","aliases":["MAL-2026-18354"],"related":[],"title":"Malicious code in trajmetrics (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271)\nWhen starting as a module, the package scans the whole system and exfiltrates selected files by type. If following the README instruction, it starts a background job constantly monitoring the system and exfiltrating files as soon as they change.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-trajmetrics\n\n\nReasons (based on the campaign):\n\n\n - native-extension\n\n\n - files-exfiltration","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"trajmetrics","fixed":[],"affected":"= 0.5.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T23:47:08+00:00","first_seen_at":"2026-10-28T01:00:03+00:00","triaged_at":"2026-10-28T01:00:29+00:00","updated_at":"2026-10-28T01:02:49+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':78C '-18354':8A,11A '-2026':7A,10A '2026':77C '3370d77977a536de8b2ea99267086960e8be3aea34a1efac6d975bb2bad98271':26C 'background':52C 'base':81C 'campaign':69C,76C,84C 'categori':66C 'chang':65C 'clear':71C 'code':2A 'constant':54C 'detail':17C 'edit':20C 'exfiltr':39C,59C,90C 'extens':87C 'file':41C,60C,89C 'files-exfiltr':88C 'follow':45C 'infosteal':75C 'instruct':48C 'intent':73C 'job':53C 'kam193':25C 'like':74C 'line':23C 'mal':6A,9A 'malici':1A,13B,67C,72C 'modul':31C 'monitor':55C 'nativ':86C 'native-extens':85C 'packag':14B,33C 'per':15C 'pypi':5A 'readm':47C 'reason':80C 'scan':34C 'select':40C 'soon':62C 'sourc':16C,24C 'start':28C,50C 'system':37C,57C 'trajmetr':4A,79C 'trajmetrics':12A 'type':43C 'whole':36C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T23:47:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18354","url":"https://osv.dev/vulnerability/MAL-2026-18354","severity":"critical","published_at":"2026-10-27T23:47:08+00:00","modified_at":"2026-10-28T00:45:08+00:00","first_seen_at":"2026-10-28T01:00:03+00:00","fetched_at":"2026-10-28T01:00:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}