# Supply Chain — holdpoint Acquisition Then Session Egress

- **Severity:** Medium
- **Signature ID:** `5f3c9e21-4b7a-4d18-9c6e-2a71d0b4e8f3`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain)

## Summary

This detects a specific two-step pattern involving the PyPI package 'holdpoint', which sits in the path an AI agent uses to get actions approved. It does not flag simply having the package installed — it flags getting it from an unusual source, or seeing a fresh install followed shortly by outbound network activity, which together look like tampering rather than normal use.

## How the attack works

An attacker (or a compromised build/dependency pipeline) delivers 'holdpoint' through an abnormal channel: a non-default package index, a disabled-TLS trusted-host flag, a raw git/http/file URL, a loose wheel or tarball, or a file staged in a temp directory rather than a normal install. Shortly after — within 15 minutes and within the same process session — something spawned by that same session makes an outbound connection. That connection is treated as suspicious if it goes to cloud metadata services, link-local, or internal (RFC1918) addresses, or if it goes to a public address and either the connecting process was started after the install or the install itself came from one of the abnormal channels above. The combination suggests a substituted or backdoored copy of the approval-queue library was installed and is now phoning out or reaching internal infrastructure it shouldn't.

## Why it matters

If an attacker can substitute the package that sits in an agent's action-approval path, they may be able to bypass approval controls or exfiltrate data/credentials through the compromised library, undermining the safeguard that is supposed to gate risky agent actions.

## What you can do

- Restrict how agent build/CI environments can install packages: disallow ad hoc --index-url, --extra-index-url, --trusted-host, or direct git/http/file installs outside approved pipelines.
- Pin 'holdpoint' (and other action-path dependencies) to a hash-locked version from a trusted internal mirror, and review any install that resolves from a temp directory (/tmp, /var/tmp, /dev/shm).
- When this fires, check the acquisition source first: if it's your own internal package mirror, it's expected — confirm the index host before treating it as an incident.
- Review the destination of the outbound connection that followed the install; confirm it is the organisation's known approval/review backend before closing the alert, and treat any cloud-metadata or unexplained public destination as high priority.

## Known benign look-alikes

- A developer or CI job legitimately installing holdpoint from an internal package mirror with --index-url / --extra-index-url — this is exactly path (A) and will report once per acquisition. Expected in shops that proxy PyPI; triage by confirming the index host is the organisation's own mirror.
- Installing holdpoint from a local checkout, built wheel, sdist tarball or git ref during development (pip install ./holdpoint-*.whl, pip install git+...). Also path (A).
- An agent that legitimately uses holdpoint's approval queue and then contacts its own internal approval/review service on an RFC1918 address inside the 15-minute window — path (B), private destination. Triage by confirming the destination is the approval backend.
- A short-lived agent session that installs holdpoint and, within the same 15 minutes, spawns a new Python process which calls a legitimate public API (model provider, telemetry). Path (B), public destination, "fresh instance" condition.
- Containerised or ephemeral build environments where the lineage root is a generic shell, making the "session" broader than a human would draw it. Lineage is emitted in the reason string so this is visible during triage.

## References

- https://attack.mitre.org/techniques/T1195/002/
- https://atlas.mitre.org/techniques/AML.T0010
- https://genai.owasp.org/llmrisk/llm03-supply-chain/

---
Source: https://www.netzilo.com/threats/holdpoint-supply-chain-session-egress