Supply Chain Multi-Agent Skill Fanout (sshlg-skills)

How the attack works

A process runs that references the sshlg or sshlg-skills package name in its command line or path — plain npm/node/yarn/pnpm activity alone does not count. That same session may then fetch a package tarball or skill file over HTTP. Within 15 minutes of the initial reference, the session writes files into the configuration directories of two or more distinct AI agent platforms. Because one package install can silently provision settings, MCP configs, hooks, and shell/JS scripts across many independently-trusted agents, a single supply chain event has a wide blast radius.

Netzilo detection

Why it matters

If the package or its update channel is ever compromised, a single install could plant configuration, hooks, or scripts across every AI coding agent a developer or CI image uses, giving an attacker a foothold that spans multiple tool trust boundaries from one delivery point.

What you can do

• →Review any host where this fires: check which agent config directories were written to (settings.json, mcp.json, hooks, .sh/.js files) and what content was added.
• →Confirm the package source and version against what you expect; verify the fetch host used during install matches the legitimate npm/package registry.
• →Restrict which processes can write to AI agent config/hook directories, and review those directories periodically for unexpected entries.
• →Avoid installing this package on shared or CI provisioning images without pinning a known-good version and auditing its contents first.

Known benign look-alikes

• A developer deliberately installing or upgrading sshlg-skills and letting it provision skills for several of their own agent platforms — this is the package's advertised behaviour and WILL match. Triage on the fetch host shown in the chain and on which artifacts were written (settings.json, mcp.json, hooks, .sh/.js are the ones that matter).
• Dotfile or monorepo bootstrap scripts that vendor an sshlg skill directory into multiple agent config trees in a single run.
• CI / workstation-image provisioning that installs agent skills for every supported platform as part of onboarding.
• A same-named internal fork or mirror of the package used intentionally by the platform team.

References

• https://attack.mitre.org/techniques/T1195/001/
• https://atlas.mitre.org/techniques/AML.T0010
• https://owasp.org/www-project-top-10-for-large-language-model-applications/

Related threats