Supply Chain dev-coder PyPI Agent Custom Endpoint Egress
dev-coder is a PyPI package that acts as a CLI coding assistant, letting users point it at any OpenAI-compatible API endpoint. This detection watches for that package's outbound traffic showing signs of contacting attacker-style infrastructure rather than a normal API host, right after the package starts running.
How the attack works
A process launches the dev-coder package, which is designed to send requests to a user-specified LLM API endpoint. Shortly after launch, the tool makes an outbound network request. The detection checks whether that request has an independent red flag: a bare IP address instead of a domain, a tunneling service or IP-encoded DNS name, plain HTTP instead of HTTPS to a public host, ingestion of a remote instruction document, a switch to a different endpoint mid-session, or a destination never seen before from a package installed in that same session. Only when the egress and the anomaly line up does anything get reported.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7f3c1e94-2b6a-4d58-9e17-c0a5b8d43f21
- Severity
- Medium
Why it matters
If a compromised or backdoored release of dev-coder existed, this is the kind of traffic pattern it would need to exfiltrate data or fetch attacker-controlled instructions. A confirmed hit means a coding agent on the host is talking to infrastructure that looks like a covert relay, which could leak source code, credentials, or prompts sent through it.
What you can do
- →Restrict which endpoints developer tools like dev-coder are allowed to reach, ideally via an allowlist of known API domains.
- →Block or closely monitor outbound tunneling services (ngrok, Cloudflare Quick Tunnel) from developer workstations unless explicitly approved.
- →If self-hosting an OpenAI-compatible server (vLLM, Ollama, LM Studio), keep it on a private address and avoid exposing it over plain HTTP or public tunnels.
- →Review any alert involving a coding CLI tool talking to a bare IP or a newly-seen endpoint before dismissing it as normal test traffic.
Known benign look-alikes
- Legitimate dev-coder use against a self-hosted OpenAI-compatible server (vLLM, Ollama, LM Studio, llama.cpp) on a private address over plain HTTP. That produces only weak indicators (bare IP on a non-public host) and stays silent unless a second, independent anomaly coincides.
- A developer deliberately exposing a local model server through ngrok / Cloudflare Quick Tunnel for remote testing. This will report -- it is indistinguishable from attacker-hosted relay infrastructure at the network layer and is worth one triage line per 30 minutes.
- Read-only inspection of the package (`pip show dev-coder`, `pip download dev-coder`, `grep -r dev-coder`). The command line matches, but no LLM-API request follows from that process inside the 15-minute window, so the rule returns allow and is invisible.
- Model A/B testing inside one dev-coder session, which trips the endpoint-pivot weak indicator. It needs a second weak indicator before anything is emitted.
- Name collision with an unrelated internal tool called dev_coder / dev-coder; the reason string names the exact process path and endpoint so triage can dismiss it in seconds.
- A CI runner that pip-installs and immediately invokes the agent every build; the per-endpoint 30-minute suppression key keeps this to one event per endpoint rather than one per request.