# Supply Chain PyPI Install of gllm-inference-binary

- **Severity:** Medium
- **Signature ID:** `7f3c1a94-2d6b-4c58-9e07-b4d1f6a83c52`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain)

## Summary

This rule flags any attempt to install, download, or run the Python package 'gllm-inference-binary' (or its underscore/dot variants). The name mimics a legitimate AI-inference library by adding a '-binary' suffix, a common typosquatting trick, though no confirmed malicious payload has been publicly documented yet.

## How the attack works

An AI agent or automated process spawns a command that installs, fetches, or executes the 'gllm-inference-binary' package via pip or a similar tool. Because Python package installation runs arbitrary code at install time (setup.py, build backends, post-install scripts), simply installing this package is enough to execute unknown code. The rule watches for this install command directly, including wheel/sdist downloads and post-install script execution, not just a generic 'pip install' pattern.

## Why it matters

If the package is not a sanctioned dependency, an organization risks running arbitrary attacker-controlled code during installation, potentially leading to code execution, credential theft, or further compromise inside build or agent environments.

## What you can do

- Check whether 'gllm-inference-binary' is an intentional, approved dependency in your requirements/lockfiles; if not, remove it and investigate how it was introduced.
- Pin and vet AI-related dependencies explicitly, watching for suffixes like '-binary' or '-utils' appended to known package names.
- Run package installs in isolated, network-restricted build environments so a malicious install script cannot reach out or persist.
- Review CI/CD and agent logs for any prior installs of this package name or its underscore/dot variants.

## Known benign look-alikes

- A developer or CI job deliberately installing this vendor distribution as a sanctioned dependency (for example restoring a pinned requirements.txt, poetry.lock or uv.lock that already references it). The event is a true observation of the install; triage confirms whether the dependency is approved.
- Malware analysts or supply-chain researchers pulling the wheel/sdist into a sandbox for inspection. Invocations through recognised audit tooling (pip-audit, safety, osv-scanner, trivy, grype, syft, snyk, guarddog, bandit, semgrep) are suppressed by filter_audit_tooling, but a plain 'pip download' in a research VM still reports.
- Dependency-resolution previews and lockfile refreshes that never execute package code — suppressed by filter_dry_run (--dry-run) and filter_inspection (pip show / list / search / freeze, poetry why, pdm tree).
- Cleanup and remediation runs (pip uninstall, poetry remove, conda remove) — suppressed by filter_removal.
- Reading, grepping or echoing the package name out of a requirements file, README, SBOM or log line — suppressed by filter_text_inspection.

## References

- https://attack.mitre.org/techniques/T1195/002/
- https://attack.mitre.org/techniques/T1059/006/
- https://atlas.mitre.org/techniques/AML.T0010

---
Source: https://www.netzilo.com/threats/pypi-gllm-inference-binary-install