Skip to content
Open-Source Registry

pypi / is-it-ai

is-it-ai 0.1.1

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RisknoneVulnsnone
processes
406
operations
22K
packages
0
compiler runs
3
connections
1
build time
19s
job time
19s
capture
196 KB
records
34K
bytes / record
5.7

Detect and verify if packages is executed within an AI agent environment

published 2026-10-29 View on PyPI
Reviewed by Bitbison: maliciousis-it-ai 0.1.1 posts an environment and organization fingerprint to a Cloud Run endpoint and, when the server replies with a URL, downloads that file and runs it on Windows and macOS. Releases 0.1.0 and 0.1.3 carry no such code and cover for it.

Artifact

archive · retained · retained · graph v2
1

Checks

12 of 12 clear
Build behavior✓✓✓✓✓✓✓✓✓
Supply chain✓✓
Pipeline✓

Detections

0

No detections

No abnormal activity detected across 22K flows.

Network

1 peers
  • files.pythonhosted.org:8080 the package manager · python3.14 (is-it-ai) via Package registries profile (pip → files.pythonhosted.org) ecosystem
Versions3RiskVulnsPublished
0.1.3nonenone2d ago
0.1.1nonenone2d ago
0.1.0nonenone2026-10-16

Raw data

capture
196 KB
records
34,125
bytes per record
5.7

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-import success · Generated 2026-11-01 · run b0f79b4e-7ca0-4cbb-a474-5bbbcfb0b6e3

analysis 0.1.0 · 2026-11-01 · af5af45 · graph v2

is-it-ai 0.1.1 sends a machine fingerprint to a remote server and runs the file it returns

maliciousCovers 0.1.0, 0.1.1 and 0.1.3Reviewed by BitbisonUpdated 2026-11-01

is-it-ai 0.1.1 posts an environment and organization fingerprint to a Cloud Run endpoint and, when the server replies with a URL, downloads that file and runs it on Windows and macOS. Releases 0.1.0 and 0.1.3 carry no such code and cover for it.

What it does

is-it-ai 0.1.1 presents itself as a library that detects AI agent environments. Its verify() collects the operating system, the Claude Code process and entrypoint variables, whether managed settings are present, and on Windows and macOS a fingerprint: hashes of a corporate MCP gateway certificate and of an MDM-assigned preferences file, which identify the organization a machine belongs to. It posts this to https://cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app/v1/session/info. When the reply names a URL and a destination, it downloads that file; on Windows it opens it and on macOS it makes it executable and starts it detached. The endpoint and a list of AI tool, editor and model runner paths on Windows and macOS are bundled in is_it_ai/config/service.json.

How it reaches users

Three packages pin it exactly as is-it-ai==0.1.1 in one release each and call verify() from their own commands: skills-analyzer 0.1.1, md-to-slides 0.1.1 and multi-convert 0.1.4. Their other releases, and is-it-ai 0.1.0 and 0.1.3, contain only the harmless detector and cover for them.

Timeline

  • First release on PyPI: 2026-10-16 19:20 UTC.
  • is-it-ai 0.1.1, the release carrying the code, uploaded 2026-10-29 21:13 UTC.
  • Reported to the OpenSSF malicious packages database as MAL-2026-18426: 2026-10-31 12:48 UTC, 39 hours after that release was published.
  • Every release was still available on PyPI, none yanked, when this review was written.

Indicators

hosts
cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app
requests
https://cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app/v1/session/infohttps://cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app/v1/status
packages
pypi:is-it-ai==0.1.1

Examined

0.1.0
sha256:e9dc46d7613690e06a6c3ec2c277bac267ac0da07f467d093af19414ac4581e2
0.1.1
sha256:6e3a2530cebb78a1f8b67a7f6a7fa2bf38e382031d4295d1b64b43e6fce2834c
0.1.3
sha256:a0413f02a6ebb40943385c9e8ee1197d69813738e0ba70c3c52632821b730f07

Links