NPM Supply Chain - create-nexus-devflow Installer Invocation
This rule flags any attempt to install or execute the NPM package @jakkrichm/create-nexus-devflow (or its unscoped create-nexus-devflow initializer form) by an AI agent or a process it spawned. It is a name-match alert, not proof of compromise: there is no confirmed malicious payload, hash, or network indicator tied to this package.
How the attack works
An agent or a spawned process runs a package-manager command such as npm install, npm create, or npx that references this exact package name. NPM initializer packages can run arbitrary code at install time via postinstall hooks and via the initializer script itself, executing with the developer's full privileges. If malicious, this would give an attacker a foothold to modify the agent's tooling or inject further backdoors, but this rule only observes the install/execute command line itself - it does not track what the package does afterward.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c1f4e28-3a6d-4b91-9c02-5f8ad3e71b64
- Severity
- Medium
Why it matters
If the package is malicious, whoever runs it hands over code execution with their own privileges, which can lead to compromised developer or agent environments and tainted tooling. Because no payload has been verified, the actual risk from this specific package is currently unconfirmed.
What you can do
- →Block or hold installs of @jakkrichm/create-nexus-devflow and create-nexus-devflow pending verification of the package contents.
- →If already installed, inspect package.json postinstall scripts and the initializer entrypoint for unexpected network calls, file writes, or credential access before removing it.
- →Review agent and CI logs for any prior invocation of this package name to determine if it already ran.
- →Restrict which package sources and package names your agents are allowed to install from, rather than allowing arbitrary npx/npm create execution.
Known benign look-alikes
- Security analyst or SOC triage inspecting the package metadata before a verdict exists - `npm view|info|show|audit @jakkrichm/create-nexus-devflow`. Suppressed by filter_pkg_inspect.
- Incident response grepping a source tree, lockfile or CI log for the package name (`grep -r create-nexus-devflow .`, `rg`, `jq` over package-lock.json). Suppressed by filter_inspect_tool.
- Remediation - `npm uninstall`, `pnpm remove`, `yarn remove` of an already-installed copy. Suppressed by filter_pkg_inspect; removal must not be reported as an install.
- Detection engineering - editing or linting this very rule file with an editor or with rulelint. Suppressed by filter_inspect_tool (editor/tool token present).
- A different, unrelated package whose unscoped initializer name ends in `create-nexus-devflow` under another scope. Branch 3 requires an install/exec verb in the same command line, but this can still fire - one reason the rule is report-only.
- A team that has independently reviewed the package and chosen to adopt it. The rule is deliberately non-blocking so an approved CI install is annotated, never broken.
- No payload, hash or C2 indicator has been verified for this package. A hit means "this named package was installed or executed here", not "this host is compromised"; triage the postinstall process tree and outbound connections before escalating.