Supply Chain Named IOC - PyPI fabric-dw Package Acquisition or Execution
A PyPI package called fabric-dw pretends to be official Microsoft Fabric tooling but actually registers itself as an MCP server, giving an attacker a foothold inside an AI agent's tool set. This rule watches for the package being installed, run, or downloaded.
How the attack works
An attacker publishes fabric-dw to PyPI, naming and describing it to look like a legitimate Microsoft Fabric utility. A victim (or an automated install/build process) pulls the package via pip, uv, pipx, poetry, or a similar tool, or fetches it directly from the PyPI index. Once present, the package can be started as an MCP server through its console script, a `python -m fabric_dw` invocation, or a direct binary call, at which point its tools become available to whatever AI agent loaded it. From there the attacker-controlled code runs inside the agent's capability set with whatever permissions that grants.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- b7f3a1d2-9c4e-4a58-8e1b-6d2f0c9a5e34
- Severity
- High
Why it matters
An AI agent ends up trusting a fake Microsoft Fabric tool as one of its capabilities, letting an attacker execute code or intercept agent actions under the guise of legitimate tooling.
What you can do
- →Search your environments and requirements/lock files for any reference to fabric-dw or fabric_dw and remove it.
- →Verify that any Microsoft Fabric tooling in use comes from Microsoft's official packages, not a similarly named third-party project.
- →Restrict which package names or sources your AI agents and build pipelines are allowed to install or load as MCP servers.
- →Review logs for pip/uv/pipx/poetry install commands and process starts referencing fabric-dw to confirm whether it was installed or run.
Known benign look-alikes
- Incident responders or an agent working the advisory - `pip uninstall fabric-dw`, `pip show fabric-dw`, `grep -r fabric-dw requirements*.txt` - suppressed by filter_removal / filter_inspection / filter_search_tools.
- Security research, rule authoring, or advisory reading where the package name appears alongside CVE/GHSA/typosquat wording - suppressed by filter_research.
- An internal or private distribution genuinely named fabric-dw, or a local project module `fabric_dw` started with `python -m fabric_dw`. This fires and is intentional - a report confirming which internal component owns the name is the desired outcome.
- Full-mirror or vendoring pipelines that pull every project from an upstream index into an internal proxy will trip the artifact-fetch branch once per sync. Expected to be a small, identifiable set of hosts in triage; the rule reports rather than blocks for this reason.
- A post-review, deliberately pinned install of the package in CI after an internal exception was granted - still reported by design, so the exception stays visible.