# Supply Chain PyPI Voice Bridge Package Install (minia-voice)

- **Severity:** Medium
- **Signature ID:** `7b3f2c9e-5d41-4a8b-9c6e-2f0a71d84e35`
- **OWASP:** LLM03 (Supply Chain)

## Summary

A PyPI package called minia-voice is advertised as a tool that reads an AI agent's final answers aloud through text-to-speech. Installing or importing it runs arbitrary code inside the agent's environment, giving that code visibility into every answer the agent produces.

## How the attack works

An attacker gets a target to install minia-voice, either through a normal package manager command, a direct URL or git reference, an alternate package index, or a loose wheel/sdist file — all common tricks for dependency confusion or typosquatting. Installing a Python package can run arbitrary setup/build code before any of the package's own logic executes. Once imported, the package sits inside the AI agent's runtime and can read or exfiltrate every final answer the agent generates. The rule also flags the module being invoked via inline 'python -c' code, a pattern typical of a dropper rather than normal usage.

## Why it matters

If installed, this gives an outside party a foothold inside the AI agent's process with access to all of its output, which could mean leaked answers, injected responses, or a stepping stone to further compromise of the host.

## What you can do

- Block installation of minia-voice until its trust status and maintainers are verified.
- Review any environment or container build that already references this package name and remove it if unapproved.
- Restrict package installs in agent runtimes to an internal, vetted index rather than allowing direct URLs, git references, or arbitrary index flags.
- Audit what code runs at package build/setup time before allowing new dependencies into agent environments.

## Known benign look-alikes

- A team that has deliberately adopted minia-voice — every container image build or environment bootstrap whose command line names the package explicitly will report once per build. Expected and intended while the package's trust status is unresolved; suppress per-project only after review, never by widening the pattern.
- Security or supply-chain analysts installing the package into a disposable sandbox to inspect it. Read-only inspection (grep/rg/cat/ls over a lockfile or requirements file) is already excluded by filter_readonly.
- Remediation and inventory work — 'pip uninstall minia-voice', 'poetry remove minia-voice', or a pip-audit/safety/trivy run naming the package — excluded by filter_remediation.
- Documentation or detection-test fixtures that literally execute the advisory's install command; these are indistinguishable from a real install at the process layer and are reported by design.
- Mirroring or artifact-caching workflows using verbs the rule does not match ('pip download', 'pip wheel', 'pip show') are not detected at all.

## References

- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
- https://attack.mitre.org/techniques/T1195/002/
- https://peps.python.org/pep-0503/#normalized-names
- https://pypi.org/project/minia-voice/

---
Source: https://www.netzilo.com/threats/pypi-minia-voice-supply-chain