Supply Chain PyPI Impersonation Package tollbooth-dpyc

How the attack works

An AI agent or a process it spawned runs a pip/install-style command or directly invokes a module that names the tollbooth-dpyc distribution, in any of its equivalent spellings (hyphen, underscore, dot, mixed case) or as a wheel filename or pinned version string. Malicious PyPI packages typically run attacker code during install (via setup.py or build hooks) and again on first import, so this command line is the earliest point where the activity can be seen. The rule only checks that the package name appears together with an install verb or direct module call in one command — it cannot confirm what code actually ran afterward.

Netzilo detection

Why it matters

If the package is malicious, the attacker gets code execution on the host at install or import time, potentially compromising the agent environment or anything it has access to. The rule surfaces the acquisition event only; it does not prove compromise occurred.

What you can do

• →Treat any hit as a lead: check the host, timestamp, and full command line before acting.
• →Do not install tollbooth-dpyc on production or agent hosts until its origin and maintainer are verified.
• →If found, isolate the host and inspect what the package's setup/build hooks and first-import code actually did.
• →Exclude known SCA/SBOM scanning tools (pip-audit, safety, osv-scanner, syft, grype, trivy) from triage since they reference package names without installing them.

Known benign look-alikes

• Malware analyst or incident responder intentionally fetching the distribution into an isolated sandbox VM for triage — a true acquisition that the rule is correct to surface, but not an incident on that host.
• The package turns out to be a legitimate MCP Lightning-payments library and a developer installs it deliberately; the rule reports rather than blocks precisely because maliciousness is unconfirmed.
• SCA / SBOM / vulnerability tooling (pip-audit, safety, osv-scanner, syft, grype, trivy) that passes the distribution name on its command line — suppressed by filter_inspection_tools.
• Remediation runs such as `pip uninstall tollbooth-dpyc` or `poetry remove tollbooth-dpyc`, and read-only subcommands such as `pip show` / `pip index` — suppressed by filter_remediation.
• Grep / ripgrep / git-log searches for the name across a repo or shell history while hunting for the package — suppressed by filter_inspection_tools.
• An internal PyPI mirror or proxy warm-up job that pre-fetches distributions by name on a build host; scope this out by peer/host at triage rather than by widening the rule.
• A CI job that echoes a previously-recorded command containing the name without executing an installer; this yields no installer verb in the same command line and will not match.

References

• https://attack.mitre.org/techniques/T1195/002/
• https://attack.mitre.org/techniques/T1059/006/
• https://atlas.mitre.org/techniques/AML.T0010
• https://genai.owasp.org/llmrisk/llm032025-supply-chain/

Related threats