PyPI Package Masquerading as LangChain Integration — Install Attempt
A malicious PyPI package named langchain-adam-network poses as a LangChain/LangGraph integration for streaming agent messages, but it is not an official package. Installing it can run arbitrary code on the machine and compromise any application that later imports it.
How the attack works
An attacker publishes a package to PyPI with a name designed to look like a real LangChain or LangGraph extension, hoping developers searching for agent-streaming tools will find and install it by mistake. A developer or automated build process runs a package manager (pip, pip3, pipx, uv, poetry, pipenv, or conda) with an install or add command naming this exact package. The install process can execute arbitrary code during setup, and any later import of the package inside an agent runtime extends that compromise to the running application.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- b6f2d8a4-3c9e-4a1f-8d7b-2e5f9c1a6b3d
- Severity
- Critical
Why it matters
Installing the package can hand an attacker code execution in the developer's build environment or production agent runtime, potentially leading to credential theft, supply-chain compromise, or full takeover of systems that run the affected agent.
What you can do
- →Block or flag installs of the package name langchain-adam-network across developer machines and CI/CD pipelines.
- →Verify LangChain/LangGraph integrations by installing only from the official LangChain organization on PyPI and cross-checking package names before adding dependencies.
- →If the package was installed outside a sandbox, treat the host and any credentials present as compromised and rebuild the environment.
- →Add dependency-name allowlisting or typosquat detection to your package-install review process, especially for AI/agent tooling searches.
Known benign look-alikes
- A security researcher or incident responder deliberately installing the package inside an isolated sandbox to analyze it
- An SBOM or dependency-audit tool that shells out to a dry-run install (e.g. "pip install --dry-run langchain-adam-network") while cataloguing a suspicious lockfile or requirements.txt entry that references the name
- A read-only metadata lookup such as "pip show langchain-adam-network" or "pip index versions langchain-adam-network" will not match this rule at all, since no install/add verb is present in the command line