Critical 2026 LLM-Based Attack Detection: AI Framework Supply Chain Compromise v

Ibrahim Saud@tektrix

•updated Sep 25, 2026•0•0•0

This rule detects potential supply chain compromise by monitoring for the installation of pip or npm packages with names similar to popular AI/LLM frameworks (e.g., langchain, llamaindex, mastra, litellm). It then correlates these installations with subsequent suspicious activity, including potential beaconing to external IPs, execution of known crypto-miners, or access to sensitive local files (e.g., AWS credentials, SSH keys).