Supply Chain AIDR npm Hook Installer Execution
This rule flags when someone runs the @coworker-jp/aidr command-line tool, or triggers its hook-installer, on a developer machine. That tool rewrites the configuration of many AI coding assistants so it can intercept every action those assistants take, which is powerful and dangerous if the package itself is compromised or a lookalike name is used instead.
How the attack works
An attacker (or a compromised/typo-squatted version of the package) gets a developer or CI runner to install or invoke @coworker-jp/aidr via npm or Node. The tool's setup routine then writes interception hooks into the configuration of 19 or more AI coding agents, positioning itself before and after every tool call those agents make. From that point on, whoever controls the hook can read or alter what the AI agents do on that machine. The rule fires on the single command line that performs this install or hook-setup step, not on later hook activity.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 8f3c1d27-5a94-4e61-9b0f-2c7d6ea41b83
- Severity
- Medium
Why it matters
If this happens with a malicious or fake copy of the package, an attacker gains a foothold that lets them observe or tamper with every action taken by AI coding agents on the affected machine, which can mean stolen code, altered commits, or manipulated agent behavior across a developer's workflow.
What you can do
- →Confirm any detected installation against an approved change ticket or platform-team rollout plan; treat unmatched hits as suspicious.
- →Verify the package name and source registry before allowing installation — watch for typosquats of @coworker-jp/aidr.
- →Restrict which machines or CI runners are allowed to install packages that modify AI agent configurations.
- →Review the resulting agent configuration files after any aidr installation to confirm only expected hooks were added.
Known benign look-alikes
- Sanctioned platform-team rollout of the AIDR CLI onto developer machines or CI runners — the alert is the audit record of that rollout and should be closed as expected once the change ticket is matched.
- CI/CD pipeline steps that intentionally install the package before running agent tests (npm ci with the scope name pinned on the command line).
- A developer upgrading an already-approved installation (npm install @coworker-jp/aidr@latest).
- Engineers inspecting or removing the package (npm view / npm uninstall / grep of a lockfile) — filtered by the inspection and removal selections.
- An unrelated internal tool whose binary is also named 'aidr' being run with a 'setup' or 'hooks' subcommand — branch B additionally requires an ai-scanner / tool-use hook token to reduce this.