# Supply Chain Suspicious PyPI Package chad-code Install or Invocation

- **Severity:** Medium
- **Signature ID:** `7f3b1c92-4d8a-4e61-9b2f-0c5a6d31e4af`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain)

## Summary

A PyPI package named chad-code markets itself as a Claude-Code-style coding agent for Apple Silicon, trading on the reputation of a trusted AI coding tool. This rule flags when an agent installs, downloads, pins, or runs that package — it does not claim the package is malicious, only that its name and branding are suspicious enough to track.

## How the attack works

An agent or developer workflow issues a command that references the distribution chad-code (or its normalised forms chad_code, chad.code) — via pip install, a direct wheel/sdist URL, a module invocation, or a pin in a dependency manifest. The detection watches the literal command text and process command lines for this exact name paired with a package-manager action, not just a mention of the name in passing text. Because the package name mimics an established AI coding agent, an unsuspecting user or automated agent could pull it in believing it's a trusted tool.

## Why it matters

If the package does carry a hidden payload, an organisation could end up running unverified, brand-impersonating code inside its development or agent environment. Right now there is no confirmed malicious behavior tied to this package — the exposure is provenance risk, not a known breach.

## What you can do

- Block or require manual approval for installs of any package literally named chad-code, chad_code, or chad.code until it has been vetted.
- Check existing dependency manifests and lockfiles for this name and remove or pin to a verified alternative if found.
- If your team needs a Claude-Code-style agent for Apple Silicon, source it from the official vendor rather than a similarly-named PyPI package.
- Treat this as a naming/impersonation signal, not a confirmed compromise — investigate context (who ran it, in what environment) before treating it as an incident.

## Known benign look-alikes

- Security researcher or SCA tooling deliberately fetching chad-code in a sandbox to analyse it (partly filtered by filter_inspection and filter_docs, but a plain "pip install" in an analysis VM will still report).
- A developer knowingly installing chad-code because they evaluated it and accepted the risk — the package is unproven, not proven malicious.
- An unrelated internal or future distribution that legitimately normalises to chad-code, chad_code or chad.code (exact name collision).
- Incident writeups, runbooks, tickets or chat transcripts that quote the install command verbatim inside a tool argument (filter_docs covers the common markers only).
- Lockfile or SBOM diffs and dependency-audit output that still list a historical chad-code pin after removal.
- Repository or directory paths that contain a chad-code segment matched by the manifest branch.

## References

- https://attack.mitre.org/techniques/T1195/002/
- https://owasp.org/www-project-top-10-for-large-language-model-applications/

---
Source: https://www.netzilo.com/threats/pypi-chad-code-supply-chain