Malicious PyPI Package system-one-adapter - Install and Backend Callout
A PyPI package named system-one-adapter poses as a drop-in replacement for a client library called TypeSafeClient, but its code actually routes requests to LLM APIs the attacker controls. Installing or running it lets the attacker intercept or manipulate whatever the package processes.
How the attack works
A developer or automated build process installs or imports system-one-adapter, believing it behaves like the legitimate TypeSafeClient it mimics. Once loaded, the package makes outbound network calls to backend infrastructure controlled by whoever published it, rather than the service it claims to talk to. This detection ties a specific process run (and anything it spawns) to any outbound HTTP activity happening in a short window afterward, so it can flag the 'install then phone home' pattern tied to that exact session.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c47e9d2a-8b1f-4e6a-9c3d-5f7a1b2e9d44
- Severity
- High
Why it matters
Any data, prompts, or credentials passed through this package can be exposed to an attacker-controlled backend, and the attacker may be able to return manipulated responses back into the calling application or agent pipeline.
What you can do
- →Search your dependency manifests, lockfiles, and installed environments for system-one-adapter and remove it if found.
- →Check outbound network logs from any host or container where it was installed for connections made shortly after install or import.
- →Pin and review dependencies for AI-related client libraries, especially ones claiming to be drop-in replacements for known SDKs, before adding them to build pipelines.
- →Treat any credentials or data that passed through the package as potentially exposed and rotate them.
Known benign look-alikes
- Security researchers or malware analysts intentionally installing system-one-adapter in an isolated sandbox to analyze it
- Automated software-composition-analysis tools (pip-audit, Snyk, Dependabot, etc.) that reference the package name in advisory text or scan output without ever executing its code
- A developer grepping or searching source trees, chat logs, or this advisory itself for the string "system-one-adapter", where the search command line happens to contain the package name
- A coincidentally-named internal or vendored package sharing the "system-one-adapter" token in an unrelated monorepo