Supply Chain PyPI Install of gllm-inference-binary
This rule flags any attempt to install, download, or run the Python package 'gllm-inference-binary' (or its underscore/dot variants). The name mimics a legitimate AI-inference library by adding a '-binary' suffix, a common typosquatting trick, though no confirmed malicious payload has been publicly documented yet.
How the attack works
An AI agent or automated process spawns a command that installs, fetches, or executes the 'gllm-inference-binary' package via pip or a similar tool. Because Python package installation runs arbitrary code at install time (setup.py, build backends, post-install scripts), simply installing this package is enough to execute unknown code. The rule watches for this install command directly, including wheel/sdist downloads and post-install script execution, not just a generic 'pip install' pattern.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7f3c1a94-2d6b-4c58-9e07-b4d1f6a83c52
- Severity
- Medium
Why it matters
If the package is not a sanctioned dependency, an organization risks running arbitrary attacker-controlled code during installation, potentially leading to code execution, credential theft, or further compromise inside build or agent environments.
What you can do
- →Check whether 'gllm-inference-binary' is an intentional, approved dependency in your requirements/lockfiles; if not, remove it and investigate how it was introduced.
- →Pin and vet AI-related dependencies explicitly, watching for suffixes like '-binary' or '-utils' appended to known package names.
- →Run package installs in isolated, network-restricted build environments so a malicious install script cannot reach out or persist.
- →Review CI/CD and agent logs for any prior installs of this package name or its underscore/dot variants.
Known benign look-alikes
- A developer or CI job deliberately installing this vendor distribution as a sanctioned dependency (for example restoring a pinned requirements.txt, poetry.lock or uv.lock that already references it). The event is a true observation of the install; triage confirms whether the dependency is approved.
- Malware analysts or supply-chain researchers pulling the wheel/sdist into a sandbox for inspection. Invocations through recognised audit tooling (pip-audit, safety, osv-scanner, trivy, grype, syft, snyk, guarddog, bandit, semgrep) are suppressed by filter_audit_tooling, but a plain 'pip download' in a research VM still reports.
- Dependency-resolution previews and lockfile refreshes that never execute package code — suppressed by filter_dry_run (--dry-run) and filter_inspection (pip show / list / search / freeze, poetry why, pdm tree).
- Cleanup and remediation runs (pip uninstall, poetry remove, conda remove) — suppressed by filter_removal.
- Reading, grepping or echoing the package name out of a requirements file, README, SBOM or log line — suppressed by filter_text_inspection.