Supply Chain - cudaq-docs-mcp Package Install via PyPI Tooling
This rule flags any command that installs or runs the cudaq-docs-mcp package using common Python package tools like pip, pipx, uv, or poetry. It exists because this package name is a known supply-chain risk: if a malicious or tampered version were published under this name, this is the exact command pattern that would pull it onto a machine.
How the attack works
An attacker (or a compromised update pipeline) publishes a trojanized version of the cudaq-docs-mcp package to PyPI. A victim, or an automated process, runs a standard install command such as pip install, pipx install, uv install, or poetry add referencing that package name. Once installed, the package can run as an MCP server, at which point it could feed manipulated documentation or code examples to an AI agent that trusts it. This detection only covers the install/run step — it does not look inside the package for malicious code.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c1a9e4d2-7b3f-4a6e-9c1d-5f8b3e2a1d47
- Severity
- High
Why it matters
If the published package is compromised, an organization installing it risks running attacker-controlled code on the host and having AI agents fed manipulated or malicious content through the MCP server, potentially leading to further compromise or bad automated decisions.
What you can do
- →Verify the source and publisher of cudaq-docs-mcp before installing it, and pin to a known-good version hash.
- →Install and test new or unfamiliar MCP packages in an isolated sandbox before allowing them in production environments.
- →Restrict which hosts or CI pipelines are allowed to install arbitrary PyPI packages, especially ones tied to AI agent tooling.
- →Review shell history and CI logs for unexpected installs of this package name, and check whether the install was intentional and approved.
Known benign look-alikes
- An AppSec/security-review team deliberately installing cudaq-docs-mcp inside an isolated sandbox to audit the package before approving it for production use.
- Shell history, tutorials, READMEs, or CI logs whose command line merely echoes/prints/greps the install instruction text rather than actually invoking pip/pipx/uv (mitigated by filter_display_only).
- A pip/pipx/uv uninstall or removal command that references the package name (mitigated by filter_uninstall).