GCVE-110-OSM-2026-2598

The tiphys-ai PyPI package masquerades as a legitimate "local-first, extensible AI agent framework" but exhibits several suspicious characteristics that suggest potential supply chain compromise or repository impersonation. The package claims to originate from https://github.com/substratum-labs/tiphys, but this repository does not exist. The domains mentioned in the package and in the support emails don't exist. This indicates either abandoned legitimate development or intentional deception. While the code contains extensive functionality for AI agent management, sandboxing, and automation, it includes powerful capabilities such as arbitrary shell command execution, dynamic Python code execution via exec(), and system integration features that could be leveraged for malicious purposes. The package appears designed to operate as a comprehensive agent framework with Discord/Telegram integration, web interfaces, and Docker sandbox management, making it attractive to developers while providing extensive system access. The malicious potential is activated upon package installation and import, as the framework initializes with broad system permissions including shell command execution through tools/shell.py and dynamic tool creation via tools/surgery.py which uses exec() to execute user-provided Python code. The package lacks obvious payload obfuscation but employs legitimate-looking Python packaging to appear benign while providing extensive system access capabilities. The framework includes Docker sandbox management, web server functionality binding to localhost:8000, and integration with external AI services (OpenRouter, OpenAI, Anthropic APIs). Key concerning functionalities include arbitrary command execution through run_command tools, dynamic Python code compilation and execution for "tool surgery," process spawning capabilities, and file system access with path traversal protections that could potentially be bypassed. The package establishes persistence through installed console scripts (tiphys command), creates local data directories, and maintains configuration through .env files. No traditional C2 infrastructure was identified, but the package's architecture allows for remote agent communication and task scheduling that could be misused for unauthorized system access. IOCs: - domains: agentskills.io, tiphys-ai.dev - emails: security@tiphys-ai.dev - payloadFileHash: 2536bacffbd409b78328ca749efa57bc8df46f2d24faea0ad631101402485de5