Supply Chain Suspicious PyPI Package agentrisk-base-v1

How the attack works

An agent or script references the distribution name agentrisk-base-v1 (or a normalized variant like agentrisk_base_v1) inside something that looks like an acquisition action: a pip install command, a requirements.txt-style manifest, a pythonhosted.org/PyPI URL, or a tool call that fetches from the package index. The rule only fires when the name and an acquisition context appear together in the same event; the name alone, or a generic install command alone, does not trigger it. The package advertises token-risk-scoring or honeypot-detection functionality, which is dual-use and unverified — the rule does not claim the package is malware.

Netzilo detection

Why it matters

If real, this behaviour means an untrusted or unvetted third-party package is being pulled into an AI agent's execution environment, which could later run arbitrary code with whatever permissions that agent has. At this stage the rule only proves an acquisition attempt happened, not that harm occurred.

What you can do

• →Check whether agentrisk-base-v1 is an approved dependency in your environment; if not, block it via a pip constraints file or internal package allow-list.
• →Review the source of the install attempt — was it triggered by agent reasoning, a user prompt, or an ingested document/feed — to rule out false positives from advisory text or SBOM reports.
• →Inspect the package contents on PyPI before allowing installation anywhere, since its actual behaviour has not been independently verified.
• →Require human review for any agent-initiated package installs from PyPI rather than letting agents install dependencies autonomously.

Known benign look-alikes

• A security analyst or threat-intel agent investigating this very advisory and pasting the install command into a tool call to reproduce it. Partially suppressed by filter_advisory and filter_metadata_lookup, but an analyst who types a bare `pip install agentrisk-base-v1` with no advisory prose around it will still be reported.
• Ingested vulnerability feeds, SBOM diffs, or vendor bulletins delivered as tool output that quote the distribution name next to a requirements.txt fragment. Suppressed by filter_advisory when standard advisory vocabulary is present.
• An internal deny-list, pip constraints file, or CI policy manifest that enumerates the package name in order to forbid it. Suppressed by the 'blocklist' / 'denylist' / 'blocked package' terms in filter_advisory.
• A private-index package that legitimately normalises to the same PEP 503 name (agentrisk_base_v1). Name collision is possible; the rule reports rather than blocks precisely because it cannot distinguish index provenance.
• Uninstall or rollback tooling cleaning the package up after an incident. Suppressed by filter_remediation.

References

• https://peps.python.org/pep-0503/#normalized-names
• https://attack.mitre.org/techniques/T1195/002/
• https://atlas.mitre.org/techniques/AML.T0010

Related threats