Supply Chain Novence PyPI Package Install
This rule watches for any command that installs a Python package called 'novence' using common package managers like pip, pipx, poetry, or conda. The package surfaced on PyPI claiming to be an official SDK, but there is no confirmed evidence it is malicious. The rule exists to answer one question: has this specific package landed on any monitored machine.
How the attack works
An attacker (or an unsuspecting developer) runs a package-manager install command that names 'novence' directly on the command line, for example 'pip install novence'. The rule matches on the combination of an install verb and the literal package name appearing together. It does not track what happens after installation, such as whether the package's code is later imported or executed, because no such behavioural telemetry is modeled here.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 3f8c1b42-6d7e-4a19-9c05-be2741d80e63
- Severity
- Medium
Why it matters
If 'novence' turns out to carry a backdoor or other malicious payload, any system where it was installed is exposed and its supply chain has been compromised. Right now there is no confirmed malicious behaviour tied to this package, so the practical impact is unknown; the value of this detection is knowing where it exists so you can react quickly if evidence changes.
What you can do
- →Search your package install logs and CI/CD pipelines for any past install of 'novence' and treat matches as an inventory item to investigate, not automatically as a compromise.
- →If found on a developer machine or agent host, isolate that host, inspect what the package actually did (network calls, file writes, imported modules), and remove it if not needed.
- →Block or flag 'novence' in your internal package proxy or artifact repository until its legitimacy is confirmed.
- →Watch for updated threat intelligence naming a specific malicious version, hash, or C2 indicator for this package, and escalate response if one appears.
Known benign look-alikes
- Security researcher or IR analyst deliberately fetching the package inside a sandbox to triage it - expected and desirable to see in the audit log.
- A developer maintaining an unrelated internal project or checkout literally named 'novence' and installing it editable from a local path (suppressed by filter_local_editable, but a non-editable local wheel install would still fire).
- Documentation, tutorial or CI-config generation that emits the literal string 'pip install novence' through echo/printf/sed (suppressed by filter_text_handling).
- Grepping shell history or build logs for the package name during hunting (suppressed by filter_text_handling).
- A future unrelated PyPI distribution whose normalised name begins with 'novence-' (for example 'novence-sdk'), which shares the word boundary.