AI Coding Agent Targeted by Malicious npm Package via Downloads Folder

A malicious instruction file in a developer's Downloads folder attempted to trick an AI coding agent into installing a known-malicious npm package. The security firm Forever Security stopped the attack before execution but could not determine how the file was introduced.

A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week.

The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder.

The file

Read original article