Suspicious Python Package Downloads from PyPI

Ankit Mehta@Secvyn

•updated Jun 17, 2026•1•0•4

This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.