Malicious PyPI Package fantasy-football-manager Acquisition

How the attack works

An attacker publishes a package named fantasy-football-manager (or an equivalent underscore/dot variant) to PyPI, styled as a fantasy football helper for AI agent tooling such as MCP clients. A victim's MCP client config, script, or manual command references the package and triggers a pip/uv/pipx/poetry-style install, or fetches the distribution file directly via curl/wget. The same package name also shows up in index lookups (/simple/<name>/, /pypi/<name>/json) and versioned wheel/sdist/tarball/zip/egg downloads. Any of these three actions — install command, direct file fetch, or index/download HTTP request — is enough to trigger detection, since it marks the point where the malicious code enters the environment.

Netzilo detection

Why it matters

If installed, this package can run attacker-controlled code inside whatever environment executes it, including AI agent runtimes that trust MCP tool packages. This rule only detects the acquisition step, not what the package does once it runs, so a hit means exposure, not necessarily confirmed compromise.

What you can do

• →Block or review installs of packages named fantasy-football-manager (and its underscore/dot variants) from PyPI unless you specifically vetted and vendored it.
• →Check MCP client configs, agent tool manifests, and CI/CD scripts for any reference to this package name.
• →If a hit is not from IR/analysis or a vetted internal package with the same name, treat it as a live compromise attempt and inspect the downloaded files before removal.
• →Restrict which package indexes and mirrors your AI agent tooling is allowed to reach, and log outbound package-index traffic.

Known benign look-alikes

• An organisation that legitimately publishes or vendors an internal package of the same name; `pip install -e` / `--editable` local development installs are filtered, but `pip install ./dist/fantasy_football_manager-<ver>.whl` from a local build of that internal package will still report.
• Malware analysts, IR responders or dependency-review staff deliberately fetching the distribution for analysis (`pip download`, `curl` of the wheel, index metadata lookup) — this is a true positive on the acquisition itself and is intentionally reported.
• A private mirror, pull-through proxy or SCA/SBOM scanner crawling the index will match the http_request branch when it prefetches or enumerates this project name.
• Removal and inspection commands (`pip uninstall`, `pip show`, `pip list`, `pip cache`, `pip audit`) are filtered and will not report.

References

• https://attack.mitre.org/techniques/T1195/001/
• https://atlas.mitre.org/techniques/AML.T0010
• https://peps.python.org/pep-0503/

Related threats