Poisoned Pipeline / Incidents / AS29
Unclaimed packages in official llms.txt files
npmPyPIAI coding agentsCDN / web assets
Alon Hertz (Evervault) scanned thousands of official llms.txt instruction
files. Many embed pip/npm install lines whose package names were never
registered. Registering a handful with a beacon produced a callback from
inside a Fortune 500 in under four minutes. Agents given only a vendor
name fetched llms.txt themselves and installed the unclaimed package.
This is dependency confusion against first-party instruction files, not
against a lockfile.
Mapped techniques
- T0102 Discover used open-source dependencies
- T0107 Discover internal artifacts names
- T0120 Dependency confusion
- T0109 Publish malicious artifact
- T0110 Advertise malicious artifact
supply-chain Unclaimed names in vendor llms.txt
Instruction files published the package names agents would install.
Names were first-party and correctly spelled, never in a public lockfile.
Registering the unclaimed name made agents install attacker code.
Names from official docs were registered on PyPI and npm.
The advertisement was the vendor's own HTTPS llms.txt.
Framework gaps noted
- Agent instruction files as a trust input are not a first-class technique.