Malicious PyPI Distribution Acquisition - book-recommendations
This detects an AI agent downloading a specific malicious Python package from PyPI that disguises itself as a helper for OpenLibrary book recommendations. The rule also flags if the same session then talks to a new external server it has never contacted before, which can indicate a follow-on stage of the attack.
How the attack works
An AI agent, acting on a task or a crafted prompt, resolves and downloads the 'book-recommendations' distribution from a Python package index. Within 10 minutes of that download, the same session makes its first-ever outbound connection to some destination it hasn't reached before. The rule links these two events into one report: the known-bad package pull, followed by unexplained new network contact. It does not detect installation or code execution — only the download and the correlated network behavior are observed.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7f3c1d8e-4b2a-4c96-9e57-2a1f0b6d84c3
- Severity
- High
Why it matters
If the package is installed and executed, an organization risks whatever payload the package delivers — potentially credential theft, data exfiltration, or a foothold for further compromise. Because this rule only confirms the download and a suspicious follow-up connection, the actual damage depends on steps this detection cannot see.
What you can do
- →Block or quarantine the 'book-recommendations' PyPI package by name across your dependency management and mirrors.
- →Review any AI agent session that pulled this package to see what task or prompt triggered the fetch.
- →Check outbound connections from that session for the destination contacted afterward, and investigate if it's unfamiliar or suspicious.
- →Add package-name allowlisting or review steps for AI agents that can autonomously install dependencies, especially from prompts or generated code.
Known benign look-alikes
- Threat-intel, malware-analysis or dependency-audit workflows that deliberately fetch the malicious distribution in order to inspect it. The acquisition is real, so the report is accurate, but it is not a compromise. Report-only action means no work is interrupted.
- An internal PyPI mirror, proxy or quarantine service pre-fetching the package on the agent's behalf. The index path shape still matches and the report is factually correct, but the agent may never install the artifact.
- A legitimately named, unrelated distribution whose artifact filename happens to contain the 'book-recommend' token (a fork, a vendored rename, or a project with a genuinely similar name). Mitigated by requiring a package-index host or a package-index path shape, so prose, blog posts, documentation and search results that merely mention the name can never match.
- Stage 2 (post-acquisition first contact) can legitimately be a brand-new destination the agent reached for the first time within ten minutes of the fetch - a newly configured API, a new model endpoint, a CDN it had not used before. Mitigated by requiring the malicious-package anchor first, strict timestamp ordering, a 10 minute window, a requirement that the destination URL node was first seen AFTER the acquisition, and a hard cap of five egress reports per session.