# Supply Chain - PyPI Install of sandbox-cli-sdk

- **Severity:** Medium
- **Signature ID:** `4f3c9b2e-7d81-4a56-9c0f-2b6e5d18a7c3`

## Summary

This detects when an AI agent, or a process it started, runs a Python package manager to install or execute the package sandbox-cli-sdk. That package is a legitimate developer tool for running commands inside isolated containers, but it can also give an agent a quiet way to run code outside normal host monitoring.

## How the attack works

An agent (or something it spawned) calls pip, uv, or a similar Python package manager with an install or run command that names sandbox-cli-sdk. Installing the package executes the publisher's setup code on the local machine, and once installed, sandbox-cli-sdk gives the agent a built-in way to launch commands inside sandbox-cli containers. Because container activity is often less visible to host-based security tools, this creates a path for an agent to execute payloads with reduced oversight. The rule only looks at a single command line: it fires when an install/run verb and the exact package name both appear together, and does not fire for uninstalls, inspection commands, or a plain text mention of the name.

## Why it matters

An organization risks an agent quietly gaining a container-execution capability that runs outside normal host visibility, and running arbitrary third-party publisher code during install. This is one narrow signal — package installation — not proof of a full compromise.

## What you can do

- Confirm whether a human explicitly requested this package before treating the alert as suspicious.
- Review whether your agents are permitted to install new dependencies unsupervised, and restrict that ability if not required.
- Check logs and container runtime activity for anything the agent ran via sandbox-cli after installation.
- Maintain an allowlist of approved packages for agent-driven environments and alert on installs outside it.

## Known benign look-alikes

- A developer or an agent acting on an explicit human request deliberately installing sandbox-cli-sdk as a project dependency.
- CI/CD or container build steps that install the project's declared dependency set with the package named inline on the command line.
- Environment reconstruction after a wipe (recreating a virtualenv, `uv sync` fallbacks that materialise the package name on the command line).
- Security or supply-chain researchers reproducing the package installation in a disposable environment for triage.
- Package pinning / upgrade automation (Dependabot-style bots, `poetry add sandbox-cli-sdk@^x.y`) run locally by a developer.

## References

- https://attack.mitre.org/techniques/T1195/002/
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/

---
Source: https://www.netzilo.com/threats/pypi-sandbox-cli-sdk-install