ChocoPoC Malicious PyPI Package Installation via frint/skytext Dependency Chain

Ethan Andrews@eandrews

•updated Jul 1, 2026•0•0•0

Detects the installation of known malicious PyPI packages ('frint', 'skytext', 'slogsec', 'logcrypt.cryptography') associated with the ChocoPoC supply chain campaign. The rule monitors process execution commands related to 'pip' package installation and tracks the appearance of malicious compiled extension files ('gradient.pyd', 'gradient.so') on the filesystem.