# PyPI Bridge Package Deceptive Naming Leads to Process Execution

- **Severity:** High
- **Signature ID:** `4b8e2f31-7c9a-4d5e-8b1a-6f3c9d2a7e04`
- **OWASP:** LLM05 (Improper Output Handling)

## Summary

Attackers publish PyPI packages named to look like official integration bridges for AI coding assistants (Claude Code, Codex, Copilot, Cursor), such as one calling itself a 'Redmine-gated pane notification bridge.' Once a developer's agent pulls in the package, it spawns a child process shortly after, running attacker code under the guise of a helpful integration.

## How the attack works

An AI coding agent fetches a package or skill document from PyPI whose name and description are crafted to sound like a legitimate notification or integration bridge for a popular AI terminal tool. Shortly after this package is acquired, a child process is spawned within the same execution lineage as the agent. Neither step is suspicious alone: installing a package and spawning a process are both normal agent activities. The suspicious signature is the pairing — deceptive bridge-branded package acquisition immediately followed by execution — within a short time window.

## Why it matters

A malicious package can execute arbitrary code on a developer's machine or CI environment under the trust developers place in AI-assistant integration tooling, potentially leading to credential theft, code tampering, or further supply-chain compromise.

## What you can do

- Review any newly added dependency with 'bridge', 'connector', or similar integration branding before allowing it to run, especially from PyPI sources not previously vetted.
- Pin and audit dependencies used by AI coding agents; require manual approval for new third-party packages rather than automatic installation.
- Restrict agent environments so that package acquisition cannot immediately trigger unreviewed process execution.
- Maintain an allowlist of known, vetted integration/bridge packages for your AI coding tools and flag any lookalike names for manual review.

## Known benign look-alikes

- A genuine, developer-installed integration tool whose name legitimately contains "bridge" (e.g. an official or well-known Redmine/Jira/Slack notification bridge for Claude Code, Codex, or another AI terminal) that also spawns a helper subprocess as part of normal startup.
- CI or test fixtures that install and immediately exercise many third-party "*-bridge" or "*-notify" packages as part of a routine dependency test suite, none of which are malicious.
- Internal, vetted tooling named e.g. "jira-bridge" or "slack-bridge" that is acquired from a trusted internal skill/MCP source and legitimately spawns a child process for its notification logic.

---
Source: https://www.netzilo.com/threats/pypi-bridge-deceptive-package-execution