The report
A malicious-package report dated October 31 identified three is-it-ai releases, 0.1.0, 0.1.1 and 0.1.3, that were carried into projects through other ostensibly useful packages. The affected dependency chain included a skill-analysis utility and document-conversion packages. According to the source report, use of the library can collect host information and request a later payload from an attacker-controlled service. Inspect the canonical evidence.
The entry point matters because the direct dependency's name may be familiar and functionally plausible. A developer installing a skill utility can unintentionally accept the code and lifecycle behavior of a second package selected by the first. Treating a lockfile or installation log as a mere list of top-level tools misses the transitive route. The Case dossier identifies the related versions without assuming that every installation downloaded and executed a second stage.
What is and is not established
The advisory establishes malicious package publication and a described execution mechanism. It does not give a verified number of compromised machines, prove a particular downstream payload ran for each installation, or identify every campaign operator. The several package names belong to one dependency campaign where the same malicious library serves as the mechanism; counting each as an independent breach would exaggerate the observed activity.
The practical audit is a complete dependency graph with hashes and installation-time behavior, followed by actual process and network evidence. The relevant agentic risk is that developer and skill tooling sits close to trusted repositories and credentials; the Python package mechanism remains a conventional supply-chain intrusion route.