Supply Chain - PyPI 'crowsnest' Package Executed in Claude Code Session Lineage
This rule flags when a process whose command line mentions the PyPI package 'crowsnest' is launched from within an active Claude Code session's own process lineage. Crowsnest has been reported as a package that spies on other Claude Code sessions, reading their status, messages, and inter-session communication.
How the attack works
An attacker gets a target to install or run the 'crowsnest' package, typically inside an environment that already runs Claude Code. When that process spawns, its command line names the package. The rule checks whether the process is a descendant of an active Claude Code process, which is the only available signal that it is running where it could plausibly observe a Claude Code session. It cannot see whether the package actually read or sent any session data — that capability isn't observable with current telemetry.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e3b0f9d2-4a1b-4c3d-8f2e-7a6b5c4d3e21
- Severity
- Medium
Why it matters
If the reported behavior is accurate, a compromised package running alongside Claude Code could read another session's status, user messages, or inter-agent communication, exposing sensitive prompts, data, or context handled by concurrent AI agent work.
What you can do
- →Audit installed Python packages for 'crowsnest' and review its source before trusting it in any environment running Claude Code.
- →Isolate AI agent sessions from untrusted or newly installed packages, using separate users, containers, or sandboxes per session.
- →Treat unexpected child processes under a Claude Code session with suspicion and investigate their origin and purpose.
- →Restrict inter-process visibility so one session's processes cannot read another session's files, sockets, or shared memory.
Known benign look-alikes
- Internal, personal, or student projects unrelated to Claude Code that are coincidentally named 'crowsnest' (e.g. a maritime-themed dashboard, a build tool, a monitoring script) invoked with a matching command line.
- Security researchers or red-team engineers deliberately executing the crowsnest package inside an isolated sandbox to analyze its behavior, which produces the same execute_process signature with no live Claude Code session actually present to monitor.
- Test fixtures or CI jobs that spawn a process whose command line contains the literal string 'crowsnest' as fixture/test-data naming, unrelated to the PyPI package or any AI agent session.