Supply Chain PyPI agents-browser Install or Execution
This rule watches for any command that installs, downloads, or runs a Python package called agents-browser (also written agents_browser or agents.browser). It's a reporting/triage signal flagging a package name of concern, not proof that a system has been compromised.
How the attack works
An attacker publishes or relies on a PyPI package named agents-browser to trick someone into installing it, often into an environment running AI agents. The rule watches process command lines for installer tools (pip, uv, poetry, pdm, rye, pipenv, hatch, pipx, conda) naming that package, or a direct download of its wheel/tarball. It also catches later execution of the package, such as running it as a module, launching its console script, or starting it with an MCP/serve subcommand. All detections rely purely on the package name appearing literally in a command line — there is no way to trace whether a process was actually produced by that installed package.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c3f9a41-2d5e-4b18-9f6a-0e83c4d7b512
- Severity
- Medium
Why it matters
If the package is malicious, running it could let an attacker execute arbitrary code inside the AI agent environment, potentially exposing credentials, data, or control over agent behavior. Because this is only a naming-based install/run signal, it identifies exposure to a suspect package, not confirmed compromise.
What you can do
- →Treat any hit as an inventory item to investigate, not an automatic incident — confirm what the package actually does before acting.
- →Check whether the install was intentional (e.g., a researcher analysing the package in a sandbox) versus unexpected in a production or CI environment.
- →Pin and review dependencies in lockfiles so unexpected package names can't silently enter build or runtime environments.
- →Restrict which package sources and names can be installed in agent-hosting environments, and require review for new dependencies.
Known benign look-alikes
- A developer or researcher deliberately installing agents-browser in a sandbox to analyse it; the install command line is identical to a victim install.
- A maintainer of a same-named local checkout running "pip install -e ./agents-browser"; no editable-install exemption is present by design, so this will report.
- CI or a container build resolving a previously pinned agents-browser dependency from a lockfile where the name is spelled out on the command line.
- An unrelated internal or private-index distribution whose PEP 503 normalised name is also agents-browser.
- A tutorial or onboarding script that runs the documented install command verbatim.