Supply Chain - Malicious CrewAI Package (crewai-true402)
A trojanized Python package named crewai-true402 poses as a legitimate CrewAI extension offering honeypot detection and SEO data features, but actually runs unauthorized code inside whatever process installs it. This detection watches for AI agents or their tools mentioning, installing, or importing this specific package.
How the attack works
An attacker publishes a package to PyPI under a name that mimics a real CrewAI tool extension, advertising plausible-sounding features to get developers or AI agents to install it. Once installed, the package runs its own code inside the host process, typically the same process running the AI agent. The detection catches this at the moment the package name appears - in a pip install command, a requirements or pyproject file edit, a Python import statement, a wheel/sdist filename, or an outbound HTTP request fetching it. It also watches for similarly-named typosquat variants in the crewai namespace when they appear in an installer command.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7b3f1c2a-9d84-4e6f-8a15-c0b7e2d34f91
- Severity
- High
Why it matters
If installed, the package executes arbitrary attacker code with the same privileges as the agent process, which can mean access to whatever credentials, data, or systems that process can reach.
What you can do
- →Search existing dependency manifests, lockfiles, and installed environments for the string 'crewai-true402' and remove it if found.
- →Review any agent logs or automation pipelines that install Python packages dynamically, and restrict them to a vetted package allowlist where possible.
- →Pin CrewAI-related dependencies to known-good versions from the verified publisher and verify package names character-by-character before install.
- →Treat SBOM or dependency-scanner output flagging this package as a real finding requiring removal, not noise, even if the verdict text is on a separate line from the package name.
Known benign look-alikes
- Security research or incident-response work where an engineer pastes the IOC into an agent prompt without any verdict wording within 200 characters of the package name (e.g. a bare column in a CSV of package names) - the adjacency filters will not catch that phrasing.
- SBOM, pip-audit, safety, Dependabot or Renovate output enumerating the package as a finding, where the tool prints the specifier form (crewai-true402==0.1.0) with the verdict on a different line.
- Reproducing the attack in a sandboxed malware-analysis or detection-engineering environment - the install command is genuinely executed and will be reported.
- The widened typosquat branch may match an internal fork or vendored build named like crewai_tools2024 or crewai-pro24 installed from a private index; the branch requires an installer verb on the same line, so prose mentions do not fire.
- An agent reading this rule file, its test fixtures, or a threat-intel feed that embeds the rule - mitigated by filter_rule_text requiring logsource + detection + falsepositives to co-occur.