# Supply Chain Acquisition of PyPI Package vedang-cli

- **Severity:** Medium
- **Signature ID:** `7b3f1c42-9d5e-4a86-b1f0-2c8e5d74a913`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain)

## Summary

This rule flags every time a machine installs, downloads, or runs a specific PyPI package called 'vedang-cli', which markets itself as an AI-agent and Web3 CLI tool with MCP-server features. It exists as a watch-list tripwire, not because the package has been confirmed malicious.

## How the attack works

Someone or some automated process runs a command — pip install, poetry add, or a direct invocation — that references the package name 'vedang-cli' in any of its normalized spellings. The rule watches the command line text for that specific package token appearing in install, artifact-download, or entry-point execution contexts. It deliberately ignores read-only inspection commands (like pip show, grep, or scans by tools such as pip-audit or trivy) so that researchers checking the package don't trigger noise. Any other appearance of the package name in an execution command line — including a genuine install — gets reported.

## Why it matters

If the package is later confirmed malicious, this is the earliest detectable moment an organization would have to catch its introduction — before any install, execution, or exfiltration chain could be observed by other means. Right now it only tells a defender that the package touched a system; it does not confirm compromise.

## What you can do

- Treat every match as a triage item, not an incident: verify who installed the package and why.
- Check whether the install was a known dependency in CI/CD or developer workflow, and suppress by pipeline or user identity rather than loosening the rule.
- If the invocation isn't explained by known research or legitimate adoption, isolate the host and inspect what the package actually did (network calls, files written, credentials accessed).
- Track for any future advisory or IOC release tied to 'vedang-cli' and revisit past alerts if one appears.

## Known benign look-alikes

- A developer who has legitimately adopted vedang-cli as a veda.ng client and is installing or running it as part of normal work. This rule reports every such invocation by design; it is a named-package watch, not a malice verdict.
- CI/CD pipelines that install the package as a declared dependency on every build, producing one report per job. Suppress by pipeline identity, not by widening the pattern.
- Security researchers detonating or unpacking the package for analysis. The common read-only verbs (pip show/list/index/inspect, poetry show, grep, cat, strings, --dry-run) and the named audit tools (pip-audit, safety, guarddog, osv-scanner, syft, trivy, snyk, semgrep) are filtered when they appear adjacent to the package token; a genuine "pip install" during detonation is still reported, which is correct.
- Uninstall/remediation commands, filtered when the removal verb sits within 80 characters of the package name.
- Documentation and shell history echoes that merely print the install string. Filtered via echo/printf/cat; if such a string is piped into a shell, the resulting child pip process emits its own execute_process event and is still caught.
- Directory or file paths that merely contain the string (for example /tmp/vedang-cli-analysis/notes.txt). The entry-point pattern requires the token to terminate at whitespace, quote, semicolon or close-paren, so a trailing hyphen or dot in a longer path does not match.

## References

- https://attack.mitre.org/techniques/T1195/002/
- https://atlas.mitre.org/techniques/AML.T0010
- https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
- https://packaging.python.org/en/latest/specifications/name-normalization/

---
Source: https://www.netzilo.com/threats/pypi-vedang-cli-acquisition