Indirect PI — Malicious Package Installation via Agent (pip/npm)
An AI assistant that can read emails or documents and run commands can be manipulated by hidden instructions in that content. The attacker plants a message telling the agent to install a malicious pip or npm package, and the agent — trusting the text it read as if it were a legitimate task — executes the install.
How the attack works
An attacker sends or plants an email or document containing hidden instructions, not visible task requests from the real user. A computer-use AI agent reads this content as part of its normal work, such as checking email. The embedded instructions tell the agent to run a pip or npm install command for a specific package name chosen by the attacker. The agent, unable to distinguish attacker text from legitimate instructions, executes the install command, pulling a malicious or fictitious package onto the system.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- cbee735b-3250-4dfa-ae39-d466bb24f524
- Severity
- Critical
Why it matters
A malicious package gets installed and can run arbitrary code with the agent's privileges, leading to further compromise, data theft, or persistent backdoor access on whatever system the agent controls.
What you can do
- →Restrict AI agents from executing package manager commands (pip, npm, etc.) without human approval.
- →Run agents with least-privilege accounts that cannot install software system-wide.
- →Review any content an agent reads (emails, documents) for embedded instructions before allowing autonomous action on it.
- →Maintain an allowlist of approved packages and block installs of anything outside it.
Known benign look-alikes
- Security research documents describing package installation attacks as examples
- Malware analysis reports that reference pip install commands in IOC sections