# Malicious PyPI Distribution Acquisition - book-recommendations

- **Severity:** High
- **Signature ID:** `7f3c1d8e-4b2a-4c96-9e57-2a1f0b6d84c3`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain)

## Summary

This detects an AI agent downloading a specific malicious Python package from PyPI that disguises itself as a helper for OpenLibrary book recommendations. The rule also flags if the same session then talks to a new external server it has never contacted before, which can indicate a follow-on stage of the attack.

## How the attack works

An AI agent, acting on a task or a crafted prompt, resolves and downloads the 'book-recommendations' distribution from a Python package index. Within 10 minutes of that download, the same session makes its first-ever outbound connection to some destination it hasn't reached before. The rule links these two events into one report: the known-bad package pull, followed by unexplained new network contact. It does not detect installation or code execution — only the download and the correlated network behavior are observed.

## Why it matters

If the package is installed and executed, an organization risks whatever payload the package delivers — potentially credential theft, data exfiltration, or a foothold for further compromise. Because this rule only confirms the download and a suspicious follow-up connection, the actual damage depends on steps this detection cannot see.

## What you can do

- Block or quarantine the 'book-recommendations' PyPI package by name across your dependency management and mirrors.
- Review any AI agent session that pulled this package to see what task or prompt triggered the fetch.
- Check outbound connections from that session for the destination contacted afterward, and investigate if it's unfamiliar or suspicious.
- Add package-name allowlisting or review steps for AI agents that can autonomously install dependencies, especially from prompts or generated code.

## Known benign look-alikes

- Threat-intel, malware-analysis or dependency-audit workflows that deliberately fetch the malicious distribution in order to inspect it. The acquisition is real, so the report is accurate, but it is not a compromise. Report-only action means no work is interrupted.
- An internal PyPI mirror, proxy or quarantine service pre-fetching the package on the agent's behalf. The index path shape still matches and the report is factually correct, but the agent may never install the artifact.
- A legitimately named, unrelated distribution whose artifact filename happens to contain the 'book-recommend' token (a fork, a vendored rename, or a project with a genuinely similar name). Mitigated by requiring a package-index host or a package-index path shape, so prose, blog posts, documentation and search results that merely mention the name can never match.
- Stage 2 (post-acquisition first contact) can legitimately be a brand-new destination the agent reached for the first time within ten minutes of the fetch - a newly configured API, a new model endpoint, a CDN it had not used before. Mitigated by requiring the malicious-package anchor first, strict timestamp ordering, a 10 minute window, a requirement that the destination URL node was first seen AFTER the acquisition, and a hard cap of five egress reports per session.

## References

- https://attack.mitre.org/techniques/T1195/001/
- https://atlas.mitre.org/techniques/AML.T0010
- https://owasp.org/www-project-top-10-for-large-language-model-applications/

---
Source: https://www.netzilo.com/threats/pypi-book-recommendations-supply-chain