Supply Chain — PyPI 'creativetasks' Acquisition and Execution (instance-resolved)

How the attack works

An analyst-facing detection watches process launches for package-manager commands (pip, uv, pipx, poetry, etc.) that include an install/add/download/run action plus the name 'creativetasks'. A simple text mention in a grep, editor, or log file does not trigger it — the tool needs to see an actual package-manager or program-entrypoint command. Once triggered, it traces the process lineage from that command (the same session and its child processes within a 15-minute window) and records any related activity, such as the installer spawning a shell or network tool, or the package reading files that look like credential paths.

Netzilo detection

Why it matters

If the package turns out to be malicious, an organization risks having an unverified tool run with a developer's or engineer's privileges, potentially exfiltrating credentials or files. Right now there is no confirmed malicious payload tied to this package, so the concrete loss is unproven — this only gives visibility into who pulled it in and what happened next.

What you can do

• →Review any alert manually before assuming compromise — this is a report-only signal, not a verified malware detection.
• →Check whether the install was an intentional evaluation by an engineer, a namespace collision with an internal package of the same name, or a researcher's sandbox test.
• →If genuinely unexpected, isolate the session's process lineage, inspect for credential-file access or unexpected outbound network activity, and rotate any credentials the process could have read.
• →Restrict who can install packages from public indexes on systems that also hold sensitive credentials or AI-agent tooling.

Known benign look-alikes

• Engineer evaluating the tool on purpose (pipx run / uvx / pip install) — reported for triage, never blocked.
• Namespace collision with an internal or personally authored package of the same name installed from a private index.
• Malware analyst or supply-chain researcher deliberately installing the package in a sandbox or CI scanning job.
• CI/build agent resolving a lockfile that happens to pin a package matching the name pattern.
• The 'Credential Access' and 'Egress' stages are context only — a legitimate agent CLI may genuinely read ~/.netrc or ~/.config/gh and may legitimately call an LLM API; neither stage is required for the finding and neither suppresses it.

References

• https://owasp.org/www-project-top-10-for-large-language-model-applications/
• https://attack.mitre.org/techniques/T1195/002/

Related threats