Supply Chain — Masquerading PyPI Package game-true402 Acquisition

How the attack works

The package advertises pay-per-call payment functions, SEO lookups, and address-safety verification for AI agents operating on the Base blockchain. These advertised features are exactly the kind that would justify requesting sensitive secrets — wallet keys, RPC endpoints, API tokens — from anyone who installs it. An AI agent (or a developer using one) references the package by name in a pip/uv/poetry/conda command, writes it into a requirements.txt or pyproject.toml file, imports the module, or fetches its wheel URL directly. This detection only covers that naming/acquisition moment — it does not see what happens after installation, such as credential theft or exfiltration.

Netzilo detection

Why it matters

If installed, this package is positioned to harvest wallet private keys, RPC credentials, and agent API tokens, which could lead to theft of funds or unauthorized use of connected services. This is an early warning of exposure, not proof that credentials were actually stolen.

What you can do

• →Block or remove any reference to game-true402 (and its variant spellings) from requirements files, lockfiles, and environments before install.
• →If the package was installed, treat any wallet keys, RPC credentials, or API tokens available to that environment as compromised and rotate them.
• →Review AI agent configurations and CI pipelines for automated dependency resolution that could pull in typosquatted or unvetted packages.
• →Require manual review of new dependencies for agents that handle wallet keys or blockchain RPC access.

Known benign look-alikes

• Security analyst or incident responder pasting the package name into an agent while researching the advisory — suppressed by filter_advisory when any advisory vocabulary (typosquat, malicious package, rug pull, CVE/GHSA/PYSEC id) is present in the same event.
• Remediation work — "pip uninstall game-true402", pip-audit / safety / osv-scanner / trivy output enumerating the package — suppressed by filter_remediation.
• Detection engineering — an agent asked to draft, review or diff this very rule, or to add the name to an internal denylist — suppressed by filter_rule_authoring.
• Dependency-scanning or mirror-sync tooling that enumerates large swathes of the PyPI name index; such output can carry both the name and "pypi.org/simple/" in one event. Confirm whether the agent resolved and downloaded an artifact or merely listed a name.
• The secondary '\btrue402\b' token is broader than the exact distribution name and could match an unrelated future package or an x402-payment discussion that also happens to sit in an install context. Verify the literal distribution name in the event before escalating.
• Reproducing the incident in a sandbox or malware-analysis VM. Scope by peer/host before treating as a live compromise.

References

• https://attack.mitre.org/techniques/T1195/002/
• https://atlas.mitre.org/techniques/AML.T0010
• https://genai.owasp.org/llmrisk/llm032025-supply-chain/

Related threats