The threat is transitive: a developer or agent may install a higher-level skill utility without explicitly selecting is-it-ai, but a pinned dependency downloads it. The payload reportedly fingerprints the host and asks an attacker-controlled endpoint for a URL to fetch and execute. The source establishes a malicious package mechanism, not completed field…
Inspect the ClaimsCase · DiggingBeagle record
AI skill utility dependencies carried malicious is-it-ai packages from PyPI
A dependency chain involving AI-facing tools reached malicious is-it-ai distributions that attempted host profiling and second-stage fetching.
Scope
No real victim count or independently observed execution of a supplied second-stage file is established.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- not established
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The OpenSSF malware advisory documents hostile package code and versions; no installation population, confirmed external victim effects or common operator identity follows automatically from that listing. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-IS-IT-AI-TRANSITIVE-MALWARE-A · GitHub Advisory GHSA-76h8-w3px-47hx, malicious is-it-ai
At a glance
An agent tooling workflow may inherit supply-chain execution authority from dependencies its user did not inspect individually.
Read the implicationsNo real victim count or independently observed execution of a supplied second-stage file is established. The actual second-stage binary served to different installations, affected user population and any cross-campaign operator identity remain unverified.
Limits and uncertaintyFull account
The threat is transitive: a developer or agent may install a higher-level skill utility without explicitly selecting is-it-ai, but a pinned dependency downloads it. The payload reportedly fingerprints the host and asks an attacker-controlled endpoint for a URL to fetch and execute. The source establishes a malicious package mechanism, not completed field compromise or a verified downloaded second stage. Its AI relevance is the skill-tool workflow rather than an assertion that the model itself generated the payload.
The OpenSSF malware advisory identifies specifically pinned malicious is-it-ai versions hidden beneath apparently ordinary utility packages. Execution is conditional: the library first fingerprints the environment and contacts an external service, then retrieves and runs a provided URL if one is returned. That mechanism differs from a benign package carrying a vulnerable dependency; the dependency is itself the intended attack payload. The advisory establishes malicious published package contents, not the number of installations receiving the second stage or an observed compromise at a named organization.
Mechanism and trust boundary
- 01
Install an apparently useful utility
The dependency graph resolves a malicious transitive PyPI package.
Boundary: Tool adoption into dependency execution
- 02
Perform host profiling
Malicious library code gathers local information and queries a remote controller.
Boundary: Dependency process into attacker service
- 03
Request second-stage code
The remote response can supply an additional executable URL.
Boundary: Network response into further code execution
Claims & evidence
CLM-2026-NOV02-IS-IT-AI-TRANSITIVE-MALWARE-AThe advisory identifies is-it-ai 0.1.0, 0.1.1 and 0.1.3 as malicious, and describes installation through other apparently useful packages, including a skill-analysis package.supported
Basis: reported finding
- supportsGitHub Advisory GHSA-76h8-w3px-47hx, malicious is-it-aiprimary disclosure
GitHub malware advisory, package dependency chain and activation
Implications
An agent tooling workflow may inherit supply-chain execution authority from dependencies its user did not inspect individually.
Controls and mitigations
- Resolve and pin the entire dependency tree, verify artifact integrity and scan import/install hooks before agent runtime adoption.
- Inspect resolved transitive versions and lockfiles, remove the affected distributions, and investigate child processes and outbound callbacks rather than searching only top-level package names.
Unknowns and contradictions
- No real victim count or independently observed execution of a supplied second-stage file is established.
- The actual second-stage binary served to different installations, affected user population and any cross-campaign operator identity remain unverified.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214