Malicious PyPI Package git-a2a Installed or Executed

How the attack works

An attacker publishes a package to PyPI under the name git-a2a, hoping developers or automated pipelines will install it by mistake or through typosquatting. The rule watches for two moments: a package manager command (pip, pipx, poetry, conda, etc.) fetching git-a2a, or the package actually being run — either via its installed command-line entry point or an inline `python -c` snippet that imports git_a2a and triggers code that runs on import. It only sees the command line text, not the package's actual contents, network traffic, or what code runs after import.

Netzilo detection

Why it matters

If installed, the package can execute attacker-controlled code on the host at install or import time, which is a common way supply-chain malware gains initial access to a developer machine or build pipeline.

What you can do

• →Search your environment and dependency manifests (requirements.txt, poetry.lock, Pipfile, environment.yml) for any reference to git-a2a, git_a2a, or git.a2a.
• →If found, remove the package immediately, rotate any credentials or tokens that were accessible on the affected machine, and treat the host as potentially compromised.
• →Block or flag installs of this package name at your package proxy or internal index if you run one.
• →Check whether the match came from a legitimate internal package with a colliding name or a researcher's sandbox test before treating it as a live compromise.

Known benign look-alikes

• Security researcher or incident responder deliberately reproducing the malicious install in a sandbox (`pip install git-a2a`). Only uninstall, download-only, --dry-run and named scanner tooling are suppressed; a genuine reproduction install will be reported, which is the intended audit outcome.
• An internal or locally developed package/checkout that happens to be named git-a2a or git_a2a and is installed from a private index or as an editable source tree. The name is highly specific, but a name collision is possible.
• A directory named git-a2a passed to a build, archive or editor command; the entry-point branch is suppressed by filter_inspection for the common navigation/read-only tools, but an unusual wrapper binary could slip through.
• Threat-intel or dependency-blocking automation that shells out to a package manager wrapper with the package name as an argument to verify it is blocked; the advisory/blocklist wording filter covers the common phrasings only.
• A shell one-liner that installs the package *and* also invokes one of the suppressed inspection tools would be reported (the inspection filter is scoped to the entry-point branch only, precisely to avoid that evasion).

References

• https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
• https://attack.mitre.org/techniques/T1195/002/
• https://attack.mitre.org/techniques/T1059/006/