# Supply Chain dev-coder PyPI Agent Custom Endpoint Egress

- **Severity:** Medium
- **Signature ID:** `7f3c1e94-2b6a-4d58-9e17-c0a5b8d43f21`
- **OWASP:** LLM03 (Supply Chain), LLM02 (Sensitive Information Disclosure)

## Summary

dev-coder is a PyPI package that acts as a CLI coding assistant, letting users point it at any OpenAI-compatible API endpoint. This detection watches for that package's outbound traffic showing signs of contacting attacker-style infrastructure rather than a normal API host, right after the package starts running.

## How the attack works

A process launches the dev-coder package, which is designed to send requests to a user-specified LLM API endpoint. Shortly after launch, the tool makes an outbound network request. The detection checks whether that request has an independent red flag: a bare IP address instead of a domain, a tunneling service or IP-encoded DNS name, plain HTTP instead of HTTPS to a public host, ingestion of a remote instruction document, a switch to a different endpoint mid-session, or a destination never seen before from a package installed in that same session. Only when the egress and the anomaly line up does anything get reported.

## Why it matters

If a compromised or backdoored release of dev-coder existed, this is the kind of traffic pattern it would need to exfiltrate data or fetch attacker-controlled instructions. A confirmed hit means a coding agent on the host is talking to infrastructure that looks like a covert relay, which could leak source code, credentials, or prompts sent through it.

## What you can do

- Restrict which endpoints developer tools like dev-coder are allowed to reach, ideally via an allowlist of known API domains.
- Block or closely monitor outbound tunneling services (ngrok, Cloudflare Quick Tunnel) from developer workstations unless explicitly approved.
- If self-hosting an OpenAI-compatible server (vLLM, Ollama, LM Studio), keep it on a private address and avoid exposing it over plain HTTP or public tunnels.
- Review any alert involving a coding CLI tool talking to a bare IP or a newly-seen endpoint before dismissing it as normal test traffic.

## Known benign look-alikes

- Legitimate dev-coder use against a self-hosted OpenAI-compatible server (vLLM, Ollama, LM Studio, llama.cpp) on a private address over plain HTTP. That produces only weak indicators (bare IP on a non-public host) and stays silent unless a second, independent anomaly coincides.
- A developer deliberately exposing a local model server through ngrok / Cloudflare Quick Tunnel for remote testing. This will report -- it is indistinguishable from attacker-hosted relay infrastructure at the network layer and is worth one triage line per 30 minutes.
- Read-only inspection of the package (`pip show dev-coder`, `pip download dev-coder`, `grep -r dev-coder`). The command line matches, but no LLM-API request follows from that process inside the 15-minute window, so the rule returns allow and is invisible.
- Model A/B testing inside one dev-coder session, which trips the endpoint-pivot weak indicator. It needs a second weak indicator before anything is emitted.
- Name collision with an unrelated internal tool called dev_coder / dev-coder; the reason string names the exact process path and endpoint so triage can dismiss it in seconds.
- A CI runner that pip-installs and immediately invokes the agent every build; the per-endpoint 30-minute suppression key keeps this to one event per endpoint rather than one per request.

## References

- https://pypi.org/project/dev-coder/
- https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
- https://genai.owasp.org/llmrisk/llm032025-supply-chain/
- https://attack.mitre.org/techniques/T1195/002/

---
Source: https://www.netzilo.com/threats/devcoder-pypi-endpoint-egress