Supply Chain — hermoso npm MCP Package Fetch
This rule flags when someone downloads the npm package 'hermoso,' which installs roughly 681 tools into an AI agent's available toolset at once. There's no known malware or vulnerability in this package — the concern is that a huge, unvetted tool surface gives a compromised or manipulated model many more ways to be misused.
How the attack works
Someone runs npm install (or a CI job restores a lockfile) that pulls the 'hermoso' package. The detection watches for the two HTTP requests this produces: a GET to the npm registry for the package metadata or version, and a GET for the tarball file itself, matching npm's standard URL path pattern. Because the tarball path check ignores the host, it also catches this traffic through internal mirrors like Artifactory, Verdaccio, Nexus, or GitHub Packages. Once installed, hermoso registers hundreds of tool descriptions into the agent's prompt context, any of which could later be invoked by a hijacked or manipulated model.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 3f0c9a41-6d2e-4b7a-9c58-1e84b2df70a5
- Severity
- Medium
Why it matters
If installed without review, an organization ends up with a much larger and less-audited tool surface available to its AI agents — each of the 681 tool descriptions is an untrusted instruction source that a compromised model could act on. This rule does not detect actual misuse or malicious code; it only flags that the package was fetched.
What you can do
- →Treat any hermoso fetch as a trigger to check whether the install was approved and why.
- →Review the full list of tools hermoso registers before allowing it in any agent-facing environment.
- →Deduplicate repeated alerts from CI pipelines or mirror sync jobs by the request URL before investigating.
- →If hermoso is not intentionally used, remove it and audit which agents had access to its tool surface in the meantime.
Known benign look-alikes
- A developer or marketing engineer deliberately evaluating or installing hermoso for approved ad/campaign work. The event is a true fetch, but not an incident — triage is "was this install sanctioned and was the 681-tool surface reviewed?", which is the entire point of reporting rather than blocking.
- Internal npm mirrors and caching proxies (Artifactory, Verdaccio, Nexus, Cloudsmith) replicating or cache-warming the public registry. The tarball branch is intentionally host-independent, so mirror sync traffic will surface here and may repeat on a schedule.
- CI/CD pipelines restoring a lockfile on every build, producing one identical event per job. High count, single root cause — dedupe on url.full before escalating.
- Software-composition-analysis scanners, dependency-confusion researchers and malware analysts pulling the tarball on purpose for inspection.
- Spanish-language content containing the word "hermoso" in a URL, slug or request body. Mitigated by requiring npm's exact package-path grammar plus the semver tarball form, and by the free-text-search and web-browse filters.