# Malicious PyPI Package git-a2a Installed or Executed

- **Severity:** Medium
- **Signature ID:** `7f3c1d64-2a95-4b0e-9c88-1e6d4a5b7c02`

## Summary

A PyPI package named git-a2a (and variants git_a2a, git.a2a) has been identified as malicious. This rule flags command-line activity that installs or runs that package.

## How the attack works

An attacker publishes a package to PyPI under the name git-a2a, hoping developers or automated pipelines will install it by mistake or through typosquatting. The rule watches for two moments: a package manager command (pip, pipx, poetry, conda, etc.) fetching git-a2a, or the package actually being run — either via its installed command-line entry point or an inline `python -c` snippet that imports git_a2a and triggers code that runs on import. It only sees the command line text, not the package's actual contents, network traffic, or what code runs after import.

## Why it matters

If installed, the package can execute attacker-controlled code on the host at install or import time, which is a common way supply-chain malware gains initial access to a developer machine or build pipeline.

## What you can do

- Search your environment and dependency manifests (requirements.txt, poetry.lock, Pipfile, environment.yml) for any reference to git-a2a, git_a2a, or git.a2a.
- If found, remove the package immediately, rotate any credentials or tokens that were accessible on the affected machine, and treat the host as potentially compromised.
- Block or flag installs of this package name at your package proxy or internal index if you run one.
- Check whether the match came from a legitimate internal package with a colliding name or a researcher's sandbox test before treating it as a live compromise.

## Known benign look-alikes

- Security researcher or incident responder deliberately reproducing the malicious install in a sandbox (`pip install git-a2a`). Only uninstall, download-only, --dry-run and named scanner tooling are suppressed; a genuine reproduction install will be reported, which is the intended audit outcome.
- An internal or locally developed package/checkout that happens to be named git-a2a or git_a2a and is installed from a private index or as an editable source tree. The name is highly specific, but a name collision is possible.
- A directory named git-a2a passed to a build, archive or editor command; the entry-point branch is suppressed by filter_inspection for the common navigation/read-only tools, but an unusual wrapper binary could slip through.
- Threat-intel or dependency-blocking automation that shells out to a package manager wrapper with the package name as an argument to verify it is blocked; the advisory/blocklist wording filter covers the common phrasings only.
- A shell one-liner that installs the package *and* also invokes one of the suppressed inspection tools would be reported (the inspection filter is scoped to the entry-point branch only, precisely to avoid that evasion).

## References

- https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
- https://attack.mitre.org/techniques/T1195/002/
- https://attack.mitre.org/techniques/T1059/006/

---
Source: https://www.netzilo.com/threats/pypi-malicious-package-git-a2a