Which versions of tao-subnet-metrics are malicious?

The following PyPI versions of tao-subnet-metrics are flagged malicious: 1.0.1. Treat any of these as compromised.

How do I remediate tao-subnet-metrics if I installed it?

tao-subnet-metrics is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed tao-subnet-metrics — how do I know if it already compromised me?

If tao-subnet-metrics was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is tao-subnet-metrics part of a known attack campaign?

Yes — tao-subnet-metrics is associated with the 2026-06-clip-logger, IN-MAL-2026-006181 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tao-subnet-metrics across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for tao-subnet-metrics (version 1.0.1).

Part of a larger attack: 2026-06-clip-logger published 9 malicious packages. See the full campaign →

Malicious package

tao-subnet-metricsPyPI

Advisory published Jun 9, 2026Updated Jun 12, 2026

tao-subnet-metrics is a confirmed malicious PyPI package (MAL-2026-5457) that steals credentials and exfiltrates sensitive data (malicious version 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in tao-subnet-metrics (PyPI)

MAL-2026-5457

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall tao-subnet-metrics

What this malware does

Package advertises itself as a Bittensor (TAO) subnet burn-rate Telegram alert tool, but the compiled extension tao_subnet_metrics/core.cpython-310-darwin.so contains an undocumented clipboard-polling daemon (symbols/docstrings: _clipboard_fingerprint, _normalize_clipboard_text, _valid_clipboard_text, Start clipboard daemon if not running, Exclusive lock so only one _run daemon polls clipboard, Send Telegram for a phrase. Skips if already sent.). The package's install subcommand registers persistent auto-start via systemd / LaunchAgent / Task Scheduler (documented as starting the burn monitor), which also launches the hidden clipboard daemon. tao_subnet_metrics/defaults.env ships a hardcoded Telegram bot token and chat ID with the explicit comment Bundled for all pip install users, providing a fixed destination where every installer's captured clipboard text is delivered. Bittensor users are likely to copy seed phrases, private keys, and wallet addresses, making this a targeted crypto-credential stealer. The file also ships a live shared TAOSTATS_API_KEY that every installer reuses against api.taostats.io.

The package contains code to steal clipboard content to a predefined remote location. If run in the right way, the code will periodically check the clipboard and if the content matches the pattern, exfiltrates it. The targeted data are likely cryptocurrency secret seed phrases.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-clip-logger

Reasons (based on the campaign):

clipboard-stealing
crypto-related

Malicious versions

1 flagged

1.0.1

Indicators of compromise (SHA-256)

44c02c7d26966977484e832411f5e67d97a9ac1795dbe2fed5d7aa7dcaeceb3f

e068049248bc5c0b4fc56cb68f5453aedf6d6cb494df9d8bba82ccc2da3eb3ad

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for tao-subnet-metrics (version 1.0.1).
If you installed it — respond
tao-subnet-metrics is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If tao-subnet-metrics was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. tao-subnet-metrics on PyPI has been identified as a malicious package (version 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-06-clip-loggerIN-MAL-2026-006181

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks tao-subnet-metrics-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database