# Supply Chain PyPI skcomms Acquisition

- **Severity:** Medium
- **Signature ID:** `7c1f4b2e-9a3d-4f68-b1c5-2e8d0a5f7364`

## Summary

This rule flags any attempt to download or install a Python package called 'skcomms', which has been reported as unvetted and possibly malicious. It's marketed as a communication library for AI agents, making it a plausible target for developers building agent-based systems.

## How the attack works

An agent or a process it spawns runs a package manager command (pip, pipx, uv, poetry, and similar tools) that names 'skcomms' as something to install, optionally pinned to version 0.2.15. Separately, the same intent can show up as a direct HTTP request to a package-index URL path containing 'skcomms', which happens when installs come from a requirements file or lockfile rather than a typed command. Either path indicates the package is being pulled into the environment.

## Why it matters

If skcomms is confirmed malicious, an organization could have it embedded in an AI agent's dependency tree, giving an attacker code execution or data access wherever that agent runs. At this stage the report only confirms the package was fetched or installed — not that harm occurred.

## What you can do

- Treat any detected skcomms install as a signal to review the requesting host and pin/lockfile source, not as confirmed compromise.
- Check whether the install came from the public PyPI index or an internal mirror before deciding on response.
- Isolate and inspect the package contents in a sandbox if you need to confirm intent, rather than running it in production.
- Hold off on blocking builds automatically until the package is independently confirmed malicious, to avoid disrupting legitimate research or CI mirroring jobs.

## Known benign look-alikes

- Malware analyst or supply-chain researcher deliberately installing skcomms==0.2.15 inside an isolated sandbox to obtain the source for review — the exact behaviour this rule reports.
- An internal or private-index distribution that happens to share the name 'skcomms'; the rule cannot distinguish index origin from the command line alone.
- CI or vendoring jobs that mirror large portions of the PyPI simple index, producing /simple/skcomms/ fetches with no intent to install.
- A README, runbook or tutorial command line echoed, printed or pasted into a terminal (mitigated for grep/cat/sed-style inspection by filter_tooling, not for bare `echo`).
- Dependency-resolution dry runs and lockfile refreshes that resolve but never install (mitigated by filter_inspection for --dry-run and pip show/list/freeze).

## References

- https://pypi.org/project/skcomms/
- https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
- https://attack.mitre.org/techniques/T1195/002/

---
Source: https://www.netzilo.com/threats/pypi-skcomms-supply-chain