Malicious Python Package Fetched from PyPI

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects attempts to fetch Python package files (setup.py or __init__.py) from pypi.org over HTTP. This activity could indicate a client attempting to download or interact with Python packages, potentially including malicious ones, from the Python Package Index. The rule uses a threshold to alert on frequent occurrences from the same source.