AI Leak Watch: Build an Import-Time Release Gate for Python AI Packages

In the event of a compromised Python AI package, a critical release gate must be established to prevent unintended execution during the import process. This gate should scrutinize the downloaded artifact, trace a cold import, and inject benign credentials to identify any malicious behavior. The incident involving MemTensor and OpenClaw plugins serves as a warning, as they employed cross-platform Go binaries named sckit, which initiated background processes, searched for developer credentials, and communicated with attacker-controlled infrastructure.

However, the findings were derived from static analysis, without executing the samples or confirming the acquisition of publishing access. Despite these limitations, a package that silently launches an undeclared executable during import should be rejected before any debate on the payload's final success. To execute this release gate, a disposable environment must be utilized, devoid of real credentials, repository write tokens, and package-publishing tokens.

The artifact must be downloaded without loading, and the registry URL, version, digest, download time, and source commit must be recorded. Provenance is crucial when the consumer verifies it against an expected source and builder. A gate should compare the package with the last approved release, focusing on new native binaries, executable permission changes, new build backends, and sudden increases in unpacked size.

The growth threshold should be set based on the package's normal history. The script should inspect the archive, comparing file facts such as size, digest, native status, and executable status. If changed native binaries, new executable permissions, or an increased unpacked size are detected, failures should be recorded. This release gate serves to safeguard Python AI packages from potential supply-chain attacks.