trajmetrics PyPI malware: system-wide file scanning and exfiltration via background job
Severity: critical · Patch status: no-fix-needed · Since 2026-10-28
The PyPI package trajmetrics version 0.5.3 has been identified as malicious code (GHSA-rm9p-x4m7-hxmp, MAL-2026-18354). When run as a module, it scans the entire system and exfiltrates selected files by type; following the README's instructions starts a persistent background job that continuously monitors the system and exfiltrates files as they change. The campaign, tracked as 2026-10-trajmetrics, uses a native extension and is classified as an infostealer with clear malicious intent (CWE-506). No patched versions exist — the package itself is malware and should be removed. Anyone who installed trajmetrics 0.5.3 should treat exfiltrated files as compromised.
What to do
- Remove trajmetrics 0.5.3 from all environments and purge caches/virtualenvs
- Audit systems where it ran for exfiltrated sensitive files (documents, credentials, keys) and rotate exposed secrets
- Check for and kill any persistent background jobs or scheduled tasks it installed
- Review logs and network egress for signs of exfiltration
- Block the package and its referenced repositories in dependency policies
Sources
All live incidents on Threat Watch
