PyPI Supply Chain - tabella-enable Package Install or Artifact Fetch

How the attack works

Someone runs a package manager command (pip, poetry, uv, etc.) that installs, adds, or syncs the tabella-enable distribution onto a host running an AI agent. The package's own entry point may then run, either as a module invocation or a console script placed in bin/Scripts/site-packages. Separately, a host may fetch the package's index page, JSON metadata, or the actual .whl/.tar.gz artifact from PyPI. Each of these is a distinct, independently observable event tied to this specific package name.

Netzilo detection

Why it matters

This rule only confirms that the package touched a given host, when, and what process launched it — it does not confirm any actual compromise. The underlying claims about MCP credential theft or data exfiltration from this package are unverified and cannot be corroborated from available telemetry; if true, an organization could face agent credential exposure or unauthorized MCP server access, but this rule does not prove that outcome.

What you can do

• →Treat any hit as a lead for manual investigation, not a confirmed compromise: pull the full process lineage (parent process, user, working directory) around the install or execution event.
• →Verify the resolved package index host and artifact hash before escalating, since internal forks or similarly-named packages can trigger false matches.
• →Check whether the activity came from a known vulnerability scanner (pip-audit, guarddog, trivy, grype, syft, snyk) or a security researcher's sandbox, and close those as expected if confirmed.
• →If tabella-enable is found running in production or near live MCP servers and model credentials, isolate the host, rotate any credentials the agent runtime had access to, and remove the package pending further review.

Known benign look-alikes

• Security researcher or malware analyst deliberately installing or fetching tabella-enable in a sandbox to triage it. Partially filtered when the run is driven by pip-audit, guarddog, trivy, grype, syft, snyk or similar; a manual 'pip install' in a lab VM will still report and should be closed as expected analyst activity.
• An internal fork, vendored copy, or unrelated project whose distribution name normalizes to the same token (tabella_enable / tabella.enable). Verify the resolved index host and artifact hash in the process lineage before escalating.
• CI or Dockerfile logs, README snippets, or shell history replay that echo an install command. The command-line selection requires a real manager invocation, and grep/rg/man lookups are filtered, but a heredoc or 'echo ... && pip install' chain can still report.
• A package mirror, proxy, or index warm-up job enumerating PyPI project JSON endpoints will match sel_http_artifact once per project. Expect exactly one hit per mirror sync, correlated with hits for many other projects at the same timestamp.
• Legitimate evaluation of the package after it has been vetted and approved. This rule is IOC-scoped, not behaviour-scoped, and cannot distinguish approved from unapproved use.

References

• https://attack.mitre.org/techniques/T1195/001/
• https://owasp.org/www-project-top-10-for-large-language-model-applications/
• https://atlas.mitre.org/techniques/AML.T0010

Related threats