Malicious Script in Developer's Downloads Foils AI Coding Assistant

According to a report published last week by security firm Forever Security, an ordinary file sitting in a programmer’s Downloads folder tried to persuade an AI‑powered coding assistant to fetch a known malicious npm package.

The event was observed in a live customer setting, where an instruction file—seemingly dropped into the developer’s default download folder—held commands that would have instructed the AI agent to install a package from the public npm registry. That package has previously been identified in supply‑chain attacks for carrying ransomware and credential‑stealing payloads.

AI coding agents, capable of producing code snippets, recommending library imports, and even executing shell commands for the user, are now standard components of contemporary development pipelines. Because they can operate autonomously, any input they receive—be it a human prompt or a script—can be turned into immediate system actions, heightening the risk of malicious exploitation.

Here, the harmful file took advantage of the assistant’s default tendency to trust file‑based directives. By issuing what appeared to be a harmless request to add a dependency, the script sought to slip past the developer’s review, banking on the AI’s quickness and convenience to finish the installation before the user could react.

During a real‑time scan of the customer’s development environment, Forever Security’s monitoring tools spotted the irregular request. The firm’s sensors marked the command as suspicious, stopped its execution, and warned the user, thereby averting the malicious package’s entry into the local node_modules directory.

The incident highlights an escalating worry among security researchers: as AI utilities become deeper parts of code creation, they also broaden the attack surface for supply‑chain threats. Threat actors are testing "prompt injection" methods to sway AI actions, and concealed files in ubiquitous folders such as Downloads offer a low‑effort pathway for these exploits.

Experts recommend that developers regard AI assistants as semi‑trusted partners rather than fully autonomous agents. Suggested safeguards involve limiting the assistant’s capacity to execute shell commands, using whitelists for vetted npm packages, and keeping a close eye on any file that might trigger automated actions.

Looking ahead, security firms expect an increase in comparable attempts and are urging tighter incorporation of threat‑detection features into AI development tools. Until such protections become commonplace, the responsibility falls on developers and organizations to deploy layered defenses capable of intercepting malicious instructions before they infiltrate the codebase.