# Supply Chain PyPI Install of claudex-export

- **Severity:** Medium
- **Signature ID:** `7c1f2b64-9d3a-4a58-b0e7-5f2c8e41d93a`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain)

## Summary

This detects when an AI coding agent (or a process it spawned) runs pip to install a specific package called claudex-export. The package claims to export Codex/Claude Code session data, but it is newly published and has not been vetted — so this flags the install attempt for review, not because malice has been confirmed.

## How the attack works

An AI agent, or a subprocess it launches, invokes a Python package installer naming the distribution claudex-export (or one of its normalized name variants, wheel/sdist filenames, or a direct/VCS URL that resolves to it). Because pip executes setup.py, PEP 517 build backends, or post-install hooks at install time, any code in the package runs before a human ever reviews it. Session-export tools are a high-value target for this kind of supply-chain risk because they legitimately need to read conversation transcripts, MCP configs, and API keys.

## Why it matters

If the package turns out to be malicious, an organization risks exposure of AI conversation transcripts, MCP configuration, and API keys at install time, before anyone inspects the code. Even if benign, unreviewed session-export tooling sitting in an agent's dependency chain is a standing risk to sensitive data.

## What you can do

- Treat any install of claudex-export as a trigger for manual review: inspect the package source, setup.py, and any post-install hooks before allowing it in production.
- Maintain an allowlist of vetted packages for AI agents and block ad-hoc installs of unreviewed dependencies outside that list.
- Audit where AI agents get read access to transcripts, MCP configs, and API keys, and restrict that access to only what is strictly necessary.
- Note that this detection does not cover requirements.txt-based installs or downstream execution/exfiltration after install — pair it with review of subprocess and network activity from newly installed packages.

## Known benign look-alikes

- A developer or security researcher deliberately installing claudex-export to evaluate, reverse-engineer or triage it. This is the single most likely match and is precisely why the rule reports rather than blocks.
- A team that has already reviewed and approved claudex-export as a sanctioned session-export utility; every subsequent pip install, upgrade or reinstall (including troubleshooting reinstalls and virtualenv rebuilds) will report.
- CI/CD or container build steps that install the package as a pinned dependency; each build run produces one report event per install invocation.
- An internal or vendored distribution that happens to normalise to the same name (e.g. a local fork published to a private index under claudex_export).
- A shell demo or onboarding script that executes a README line verbatim; the read-only-inspection filter only removes viewing of that text, not executing it.

## References

- https://attack.mitre.org/techniques/T1195/002/
- https://atlas.mitre.org/techniques/AML.T0010
- https://packaging.python.org/en/latest/specifications/name-normalization/

---
Source: https://www.netzilo.com/threats/pypi-claudex-export-install