# Indirect PI — Malicious Package Installation via Agent (pip/npm)

- **Severity:** Critical
- **Signature ID:** `cbee735b-3250-4dfa-ae39-d466bb24f524`
- **MITRE ATLAS:** AML.T0011.001 (Malicious Package), AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection)

## Summary

An AI assistant that can read emails or documents and run commands can be manipulated by hidden instructions in that content. The attacker plants a message telling the agent to install a malicious pip or npm package, and the agent — trusting the text it read as if it were a legitimate task — executes the install.

## How the attack works

An attacker sends or plants an email or document containing hidden instructions, not visible task requests from the real user. A computer-use AI agent reads this content as part of its normal work, such as checking email. The embedded instructions tell the agent to run a pip or npm install command for a specific package name chosen by the attacker. The agent, unable to distinguish attacker text from legitimate instructions, executes the install command, pulling a malicious or fictitious package onto the system.

## Why it matters

A malicious package gets installed and can run arbitrary code with the agent's privileges, leading to further compromise, data theft, or persistent backdoor access on whatever system the agent controls.

## What you can do

- Restrict AI agents from executing package manager commands (pip, npm, etc.) without human approval.
- Run agents with least-privilege accounts that cannot install software system-wide.
- Review any content an agent reads (emails, documents) for embedded instructions before allowing autonomous action on it.
- Maintain an allowlist of approved packages and block installs of anything outside it.

## Known benign look-alikes

- Security research documents describing package installation attacks as examples
- Malware analysis reports that reference pip install commands in IOC sections

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00712

---
Source: https://www.netzilo.com/threats/atr-indirect-pi-malicious-package-installation-via-agent-pip-npm