Your Downloads Folder Can Now Give Orders to Your AI Coding Agent
No Comments on Your Downloads Folder Can Now Give Orders to Your AI Coding Agent
Researchers found a malicious AGENTS.md in a customer's Downloads folder that pushed an AI coding agent to install a rogue npm package. Here is what was reported, why it works, and what to change today.
SlugFest: How a Repo Rename Could Hand Your npm Package to an Attacker
Bloom Security found that npm trusted publishing trusted a repository's name instead of its permanent ID until the first publish, leaving 1,500+ packages open to hijacking. GitHub has now added a 48-hour validation window, but maintainers still have…
MALFEX: Eight Malicious npm Packages, 40,767 Downloads, and an ASCII Art Font That Drops a RAT
A lone, Portuguese-speaking operator has been seeding npm with malware since 2023, and three of the eight flagged packages are reportedly still live. Here's how the MALFEX campaign works and what I'd check in my own projects today.