Supply Chain Suspicious PyPI Package chad-code Install or Invocation
A PyPI package named chad-code markets itself as a Claude-Code-style coding agent for Apple Silicon, trading on the reputation of a trusted AI coding tool. This rule flags when an agent installs, downloads, pins, or runs that package — it does not claim the package is malicious, only that its name and branding are suspicious enough to track.
How the attack works
An agent or developer workflow issues a command that references the distribution chad-code (or its normalised forms chad_code, chad.code) — via pip install, a direct wheel/sdist URL, a module invocation, or a pin in a dependency manifest. The detection watches the literal command text and process command lines for this exact name paired with a package-manager action, not just a mention of the name in passing text. Because the package name mimics an established AI coding agent, an unsuspecting user or automated agent could pull it in believing it's a trusted tool.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7f3b1c92-4d8a-4e61-9b2f-0c5a6d31e4af
- Severity
- Medium
Why it matters
If the package does carry a hidden payload, an organisation could end up running unverified, brand-impersonating code inside its development or agent environment. Right now there is no confirmed malicious behavior tied to this package — the exposure is provenance risk, not a known breach.
What you can do
- →Block or require manual approval for installs of any package literally named chad-code, chad_code, or chad.code until it has been vetted.
- →Check existing dependency manifests and lockfiles for this name and remove or pin to a verified alternative if found.
- →If your team needs a Claude-Code-style agent for Apple Silicon, source it from the official vendor rather than a similarly-named PyPI package.
- →Treat this as a naming/impersonation signal, not a confirmed compromise — investigate context (who ran it, in what environment) before treating it as an incident.
Known benign look-alikes
- Security researcher or SCA tooling deliberately fetching chad-code in a sandbox to analyse it (partly filtered by filter_inspection and filter_docs, but a plain "pip install" in an analysis VM will still report).
- A developer knowingly installing chad-code because they evaluated it and accepted the risk — the package is unproven, not proven malicious.
- An unrelated internal or future distribution that legitimately normalises to chad-code, chad_code or chad.code (exact name collision).
- Incident writeups, runbooks, tickets or chat transcripts that quote the install command verbatim inside a tool argument (filter_docs covers the common markers only).
- Lockfile or SBOM diffs and dependency-audit output that still list a historical chad-code pin after removal.
- Repository or directory paths that contain a chad-code segment matched by the manifest branch.