PyPI Bridge Package Deceptive Naming Leads to Process Execution
Attackers publish PyPI packages named to look like official integration bridges for AI coding assistants (Claude Code, Codex, Copilot, Cursor), such as one calling itself a 'Redmine-gated pane notification bridge.' Once a developer's agent pulls in the package, it spawns a child process shortly after, running attacker code under the guise of a helpful integration.
How the attack works
An AI coding agent fetches a package or skill document from PyPI whose name and description are crafted to sound like a legitimate notification or integration bridge for a popular AI terminal tool. Shortly after this package is acquired, a child process is spawned within the same execution lineage as the agent. Neither step is suspicious alone: installing a package and spawning a process are both normal agent activities. The suspicious signature is the pairing — deceptive bridge-branded package acquisition immediately followed by execution — within a short time window.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4b8e2f31-7c9a-4d5e-8b1a-6f3c9d2a7e04
- Severity
- High
Why it matters
A malicious package can execute arbitrary code on a developer's machine or CI environment under the trust developers place in AI-assistant integration tooling, potentially leading to credential theft, code tampering, or further supply-chain compromise.
What you can do
- →Review any newly added dependency with 'bridge', 'connector', or similar integration branding before allowing it to run, especially from PyPI sources not previously vetted.
- →Pin and audit dependencies used by AI coding agents; require manual approval for new third-party packages rather than automatic installation.
- →Restrict agent environments so that package acquisition cannot immediately trigger unreviewed process execution.
- →Maintain an allowlist of known, vetted integration/bridge packages for your AI coding tools and flag any lookalike names for manual review.
Known benign look-alikes
- A genuine, developer-installed integration tool whose name legitimately contains "bridge" (e.g. an official or well-known Redmine/Jira/Slack notification bridge for Claude Code, Codex, or another AI terminal) that also spawns a helper subprocess as part of normal startup.
- CI or test fixtures that install and immediately exercise many third-party "*-bridge" or "*-notify" packages as part of a routine dependency test suite, none of which are malicious.
- Internal, vetted tooling named e.g. "jira-bridge" or "slack-bridge" that is acquired from a trusted internal skill/MCP source and legitimately spawns a child process for its notification logic.