Which versions of tao-subnet-metrics are malicious?

The following PyPI versions of tao-subnet-metrics are flagged malicious: 1.0.1. Treat any of these as compromised.

How do I remediate tao-subnet-metrics if I installed it?

tao-subnet-metrics is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed tao-subnet-metrics — how do I know if it already compromised me?

If tao-subnet-metrics was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is tao-subnet-metrics part of a known attack campaign?

Yes — tao-subnet-metrics is associated with the 2026-06-clip-logger, IN-MAL-2026-006181 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tao-subnet-metrics across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for tao-subnet-metrics (version 1.0.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging tao-subnet-metrics across your stack and pipelines.

Malicious package

tao-subnet-metricsPyPI

Malicious code in tao-subnet-metrics (PyPI) Remove it immediately and rotate any exposed credentials.

MAL-2026-5457

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

pip uninstall tao-subnet-metrics

What this malware does

Package advertises itself as a Bittensor (TAO) subnet burn-rate Telegram alert tool, but the compiled extension tao_subnet_metrics/core.cpython-310-darwin.so contains an undocumented clipboard-polling daemon (symbols/docstrings: _clipboard_fingerprint, _normalize_clipboard_text, _valid_clipboard_text, Start clipboard daemon if not running, Exclusive lock so only one _run daemon polls clipboard, Send Telegram for a phrase. Skips if already sent.). The package's install subcommand registers persistent auto-start via systemd / LaunchAgent / Task Scheduler (documented as starting the burn monitor), which also launches the hidden clipboard daemon. tao_subnet_metrics/defaults.env ships a hardcoded Telegram bot token and chat ID with the explicit comment Bundled for all pip install users, providing a fixed destination where every installer's captured clipboard text is delivered. Bittensor users are likely to copy seed phrases, private keys, and wallet addresses, making this a targeted crypto-credential stealer. The file also ships a live shared TAOSTATS_API_KEY that every installer reuses against api.taostats.io.

The package contains code to steal clipboard content to a predefined remote location. If run in the right way, the code will periodically check the clipboard and if the content matches the pattern, exfiltrates it. The targeted data are likely cryptocurrency secret seed phrases.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-clip-logger

Reasons (based on the campaign):

clipboard-stealing
crypto-related

Malicious versions

1 flagged

1.0.1

Indicators of compromise (SHA-256)

44c02c7d26966977484e832411f5e67d97a9ac1795dbe2fed5d7aa7dcaeceb3f

e068049248bc5c0b4fc56cb68f5453aedf6d6cb494df9d8bba82ccc2da3eb3ad

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for tao-subnet-metrics (version 1.0.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging tao-subnet-metrics across your stack and pipelines.
If you installed it — respond
tao-subnet-metrics is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If tao-subnet-metrics was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks tao-subnet-metrics before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. tao-subnet-metrics on PyPI has been identified as a malicious package (version 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

2026-06-clip-loggerIN-MAL-2026-006181

References

Credits

Amazon Inspector · finder
Kamil Mańkowski (kam193) · reporter

Detect & block this

O3 blocks tao-subnet-metrics-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring