Supply Chain Suspicious npm Package Install (@aigent-hive)

How the attack works

An attacker, or someone unknowingly following bad instructions, runs a package manager command that references @aigent-hive/darwin-arm64, either installing it directly or spawning a process that invokes it. This triggers a registry fetch that downloads the scoped tarball containing the ARM64 binary. If the package behaves as its name implies, it could then authenticate to a subscription service and harvest credentials or maintain control of an agent process — but this later behavior has not been observed or verified, only inferred from the package's name and description.

Netzilo detection

Why it matters

If the underlying concern is accurate, an organization could lose control of credentials used to authenticate AI agent subscriptions, or have an unauthorized agent runtime persist on a host. This rule only confirms that the package was fetched or referenced — it does not confirm any actual compromise occurred.

What you can do

• →Treat any match as a lead to investigate, not a confirmed incident — pull the transcript and identify who ran the command and why.
• →If the package was installed outside a sandbox or deliberate analysis context, isolate the host and inspect the binary before allowing further execution.
• →Check whether the install was part of routine dependency inspection (npm view, npm ls, dry-run) or remediation (uninstall, audit fix) before escalating.
• →Restrict which npm scopes or registries hosts can install from if you want to prevent unreviewed packages like this from landing on production systems.

Known benign look-alikes

• A security engineer or malware analyst deliberately installing @aigent-hive/darwin-arm64 in a sandbox to reproduce and triage this very report. This is the single most likely trigger and is exactly why the rule is report-only — it is a lead, not a verdict.
• Remediation work — uninstalling the package or running `npm audit fix` — where the transcript also quotes the original install command (suppressed by filter_remediation).
• Dependency inspection that does not install — `npm view`, `npm ls`, `npm explain`, `--dry-run`, `--package-lock-only` (suppressed by filter_dry_run).
• The agent reading a vendor advisory, changelog, blog post or internal write-up that quotes `npm install @aigent-hive/darwin-arm64` (suppressed by filter_advisory when an advisory/CVE marker is present; prose that quotes the command with no such marker will still report).
• The package is a legitimately published, benign harness. The detection is name/publisher based, not payload based; no malicious behaviour has been confirmed. A first-party team that has approved this dependency will generate one report per install and per binary launch.
• A CI or build transcript replayed through the agent that echoes an install line from a lockfile-driven `npm ci` run.

References

• https://attack.mitre.org/techniques/T1195/002/
• https://atlas.mitre.org/techniques/AML.T0010
• https://genai.owasp.org/llmrisk/llm032025-supply-chain/

Related threats