Malicious PyPI Package Install/Exec — llm-project-generator

How the attack works

An attacker publishes a package under a name that sounds useful to developers building LLM tools. A developer finds it and installs it with pip, pipx, uv, poetry, or conda, or later runs it directly via its command-line entry point or with 'python -m'. The detection watches for any of these install or execution actions naming this specific package. It does not cover what the package does once running, only that it was fetched or invoked.

Netzilo detection

Why it matters

If the package contains malicious code, installing or executing it can give an attacker code execution on the developer's machine or in a CI pipeline, potentially leading to credential theft or further compromise of build systems.

What you can do

• →Search installed-package lists, lockfiles, and requirements files across developer machines and CI systems for 'llm-project-generator'.
• →If found, remove it and treat any host that ran it as potentially compromised — rotate credentials and check for follow-on activity.
• →Review your policy for installing packages from PyPI without vetting, especially ones related to popular LLM frameworks.
• →Pin approved dependencies and use an internal package proxy or allowlist to prevent ad hoc installs of unreviewed packages.

Known benign look-alikes

• pip show llm-project-generator or pip uninstall llm-project-generator run by a security team inspecting or removing the package after an advisory — excluded because sel_install requires an install|add verb, not show|uninstall|download.
• A CI job or script that greps/greps-through an installed-package list or a requirements.txt for the string without actually invoking pip/pipx/uv/poetry/conda with an install|add verb — does not match sel_install.
• A hypothetical, unrelated legitimate package whose name has this exact string as a prefix (e.g. llm-project-generator-extras) could still match sel_direct_exec if invoked with a trailing separator boundary; no such package is known to exist on PyPI at authoring time. Because this rule only reports, the cost of that edge case is a triage entry, not a block.
• A developer inspecting the malicious package's source locally (e.g. opening it in an editor, reading its files) without spawning a process that installs or runs it does not match — execute_process only fires on actual process spawns.