Potentially Malicious PyPI Package - shipteam
A package named 'shipteam' on PyPI describes itself as a 'Claude Code and Codex CLI framework installer,' a description that mimics legitimate AI coding assistant tools from Anthropic and OpenAI. This rule flags when someone runs pip, pipx, uv, or uvx to install this specific package, so the attempt can be reviewed before assuming it's safe.
How the attack works
An attacker publishes a package to PyPI under a name and description crafted to look like an official installer for popular AI coding CLI tools. A developer or automated process, expecting to install the real Claude Code or Codex CLI tooling, instead runs a pip/pipx/uv/uvx install command that pulls this package. Whatever the package actually does upon install runs in that user's or system's context. The rule only catches the install command being executed, not any payload behavior, so it flags the attempt for someone to check rather than confirming malicious intent.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6e2a1f3d-8c4b-4a9e-9f1d-3b7c5e2a8d6f
- Severity
- Medium
Why it matters
If the package contains a malicious payload, installing it could hand an attacker code execution on a developer machine or build system, potentially exposing credentials, source code, or CI/CD access. No malicious behavior has been confirmed for this package at this time — this only detects the install attempt.
What you can do
- →Block or quarantine any host where this install command ran until the package contents are reviewed.
- →Check whether the install was intentional (e.g., a researcher in a sandbox) or came from an unfamiliar script, dependency file, or instruction.
- →Pin your projects to known-good package names and sources, and use an internal package index allowlist where possible.
- →If your organization has an internal tool also named 'shipteam', confirm the install pointed to your private index and not the public PyPI package.
Known benign look-alikes
- An internal or private PyPI index/mirror hosting an unrelated, legitimately named internal tool that also happens to be called "shipteam" (e.g. a company shipping/logistics team's internal package).
- A security researcher or engineer intentionally installing the flagged package inside an isolated sandbox/VM to analyze it for this exact report.
- A CI pipeline log or documentation snippet that echoes the string "pip install shipteam" as an example without actually executing it (this rule only fires on execute_process, i.e. the command was actually run, not merely printed or logged as text).