# Supply Chain Suspicious npm Package Install (@aigent-hive)

- **Severity:** Medium
- **Signature ID:** `7f3c1a92-4d8e-4b6a-9c05-2e1f8a6b3d47`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain)

## Summary

This rule flags any attempt to install, run, or download the npm package @aigent-hive/darwin-arm64 (or its sibling platform builds), which is marketed as a local agent harness for subscription-authenticated AI hosts. The package itself has not been confirmed malicious — there is no advisory, CVE, or code analysis behind this — the flag exists because the name and description suggest it could harvest credentials or gain persistent control of an agent runtime.

## How the attack works

An attacker, or someone unknowingly following bad instructions, runs a package manager command that references @aigent-hive/darwin-arm64, either installing it directly or spawning a process that invokes it. This triggers a registry fetch that downloads the scoped tarball containing the ARM64 binary. If the package behaves as its name implies, it could then authenticate to a subscription service and harvest credentials or maintain control of an agent process — but this later behavior has not been observed or verified, only inferred from the package's name and description.

## Why it matters

If the underlying concern is accurate, an organization could lose control of credentials used to authenticate AI agent subscriptions, or have an unauthorized agent runtime persist on a host. This rule only confirms that the package was fetched or referenced — it does not confirm any actual compromise occurred.

## What you can do

- Treat any match as a lead to investigate, not a confirmed incident — pull the transcript and identify who ran the command and why.
- If the package was installed outside a sandbox or deliberate analysis context, isolate the host and inspect the binary before allowing further execution.
- Check whether the install was part of routine dependency inspection (npm view, npm ls, dry-run) or remediation (uninstall, audit fix) before escalating.
- Restrict which npm scopes or registries hosts can install from if you want to prevent unreviewed packages like this from landing on production systems.

## Known benign look-alikes

- A security engineer or malware analyst deliberately installing @aigent-hive/darwin-arm64 in a sandbox to reproduce and triage this very report. This is the single most likely trigger and is exactly why the rule is report-only — it is a lead, not a verdict.
- Remediation work — uninstalling the package or running `npm audit fix` — where the transcript also quotes the original install command (suppressed by filter_remediation).
- Dependency inspection that does not install — `npm view`, `npm ls`, `npm explain`, `--dry-run`, `--package-lock-only` (suppressed by filter_dry_run).
- The agent reading a vendor advisory, changelog, blog post or internal write-up that quotes `npm install @aigent-hive/darwin-arm64` (suppressed by filter_advisory when an advisory/CVE marker is present; prose that quotes the command with no such marker will still report).
- The package is a legitimately published, benign harness. The detection is name/publisher based, not payload based; no malicious behaviour has been confirmed. A first-party team that has approved this dependency will generate one report per install and per binary launch.
- A CI or build transcript replayed through the agent that echoes an install line from a lockfile-driven `npm ci` run.

## References

- https://attack.mitre.org/techniques/T1195/002/
- https://atlas.mitre.org/techniques/AML.T0010
- https://genai.owasp.org/llmrisk/llm032025-supply-chain/

---
Source: https://www.netzilo.com/threats/npm-aigent-hive-supply-chain