· ai-devtools
Forever Security finds malicious file tries to trick AI coding agent into installing npm malware
An instruction file, designed to be malicious, was found within a developer's Downloads folder.
This file attempted to trick an AI coding agent into installing a known-malicious npm package, according to a report released last week by security firm Forever Security.
The security firm successfully intercepted this dangerous attempt on one of their actual customers' systems. Crucially, the agent was halted before any malicious code could actually execute.
Forever Security noted that they were unable to ascertain the origin of the file within the folder. This incident highlights a growing vector for supply chain attacks targeting development workflows.
The attempt involved leveraging an AI coding agent, a tool increasingly integrated into modern developer environments. This showcases a new layer of risk associated with automated coding assistance.
