# Supply Chain PyPI ankora-memory Acquisition

- **Severity:** High
- **Signature ID:** `7c3f5a91-2d64-4e0b-9a58-6f1c8b40d2e7`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain)

## Summary

ankora-memory is a PyPI package advertised as persistent-memory tooling for AI coding agents, but it has been identified as a way to smuggle malicious code into agent environments. This detection flags when an AI agent actually installs, imports, pins, or downloads this package, rather than just mentioning it in text.

## How the attack works

An AI coding agent is instructed, tricked, or configured to add ankora-memory as a dependency, believing it provides useful persistent-memory features. The agent then runs an install command, writes an import statement, pins the package in a requirements/manifest file, or fetches it directly from the PyPI index. Once installed, the package's code runs inside the agent's runtime, giving an attacker a foothold inside whatever environment the agent operates in. The detection only fires on these concrete actions — a command, an import, a pin, or a fetch — not on the package name simply appearing in conversation or documentation.

## Why it matters

If installed, the package can run arbitrary code inside the agent's execution environment, potentially exposing credentials, source code, or other data the agent can access, and giving an attacker a foothold in the agent's runtime or the broader development pipeline.

## What you can do

- Block or flag installation of 'ankora-memory' in any agent-controlled environment via dependency allowlists or package policy.
- Search existing agent logs, manifests, and lockfiles for prior references to this package and treat any hit as a potential compromise needing investigation.
- Review agent tool-use permissions so agents cannot install arbitrary packages without human approval.
- Distinguish deliberate security testing or SBOM/audit work (which may legitimately reference this package) from unexpected or unreviewed installs before escalating.

## Known benign look-alikes

- Security or platform engineer using an agent to reproduce the supply-chain incident in a disposable sandbox (install verb present, no advisory keywords).
- Dependency-audit or SBOM-generation agent that emits a requirements-style line for the package while inventorying an already-infected project, if the output carries no advisory vocabulary.
- Internal mirror/proxy warming or vendoring job that fetches /simple/ index pages for every package name in a corpus, including this one.
- Incident-response runbook or detection-engineering document that quotes a literal `pip install ankora-memory` line without any advisory wording around it.

## References

- https://attack.mitre.org/techniques/T1195/002/
- https://peps.python.org/pep-0503/

---
Source: https://www.netzilo.com/threats/pypi-ankora-memory-supply-chain