known-malicious npm package

Malicious Instruction File Targets AI Coding Agent via Downloads Folder

A malicious instruction file discovered in a developer's Downloads folder attempted to manipulate an AI coding agent into installing a known-malicious npm package. The security firm Forever Security detected and stopped the attempt on a real customer machine before any code executed. The origin of how the file entered the Downloads folder remains unconfirmed.