
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
metrohash
Advanced tools
Python wrapper for MetroHash, a fast non-cryptographic hash function.
To use this package in your program, simply type
pip install metrohash
After that, you should be able to import the module and do things with it (see usage example below).
This package provides Python interfaces to 64- and 128-bit
implementations of MetroHash algorithm. For stateless hashing, it
exports metrohash64 and metrohash128 functions. Both take a value to
be hashed and an optional seed parameter:
>>> import metrohash
...
>>> metrohash.hash64_int("abc", seed=0)
17099979927131455419
>>> metrohash.hash128_int("abc")
182995299641628952910564950850867298725
Unlike its cousins CityHash and FarmHash, MetroHash allows incremental
(stateful) hashing. For incremental hashing, use MetroHash64 and
MetroHash128 classes. Incremental hashing is associative and
guarantees that any combination of input slices will result in the same
final hash value. This is useful for processing large inputs and stream
data. Example with two slices:
>>> mh = metrohash.MetroHash64()
>>> mh.update("Nobody inspects")
>>> mh.update(" the spammish repetition")
>>> mh.intdigest()
7851180100622203313
The resulting hash value above should be the same as in:
>>> mh = metrohash.MetroHash64()
>>> mh.update("Nobody inspects the spammish repetition")
>>> mh.intdigest()
7851180100622203313
The Python Buffer Protocol allows Python objects to expose their data as raw byte arrays to other objects, for fast access without copying to a separate location in memory. Among others, NumPy is a major framework that supports this protocol.
All hashing functions in this packege will read byte arrays from objects that expose them via the buffer protocol. Here is an example showing hashing of a 4D NumPy array:
>>> import numpy as np
>>> arr = np.zeros((256, 256, 4))
>>> metrohash.hash64_int(arr)
12125832280816116063
The arrays need to be contiguous for this to work. To convert a
non-contiguous array, use NumPy's ascontiguousarray() function.
For those who want to contribute, here is a quick start using some makefile commands:
git clone https://github.com/escherba/python-metrohash.git
cd python-metrohash
make env # create a virtual environment
make test # run Python tests
make cpp-test # run C++ tests
make shell # enter IPython shell
To find out which Make targets are available, type:
make help
The wheels are built using cibuildwheel and are distributed to PyPI using GitHub actions. The wheels contain compiled binaries and are available for the following platforms: windows-amd64, ubuntu-x86, linux-x86_64, linux-aarch64, and macosx-x86_64.
For other fast non-cryptographic hash functions available as Python extensions, see FarmHash and MurmurHash.
The MetroHash algorithm and C++ implementation is due to J. Andrew Rogers. The Python bindings for it were written by Eugene Scherba.
This software is licensed under the Apache License, Version 2.0. See the included LICENSE file for details.
FAQs
Python bindings for MetroHash, a fast non-cryptographic hash algorithm
We found that metrohash demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.