AI Coding Assistant Thwarted by Malicious Script Hidden in Developer’s Downloads Folder

A routine file in a programmer's Downloads directory attempted to coerce an AI‑powered coding assistant into pulling a known malicious npm package, according to a report released by security firm Forever Security last week.

The incident was captured on a live customer environment, where an instruction file—apparently placed in the developer’s default download location—contained commands that would have directed the AI agent to execute a package installation from the public npm registry. The package in question has been flagged in previous supply‑chain attacks for embedding ransomware and credential‑stealing payloads.

AI coding agents, which can generate code snippets, suggest library imports, and even run shell commands on behalf of the user, have become common fixtures in modern development workflows. Their ability to act autonomously means that any input they accept—whether from a human prompt or a script—can translate directly into system actions, raising the stakes for malicious manipulation.

In this case, the malicious file leveraged the assistant’s default behavior of trusting file‑based instructions. By presenting a seemingly innocuous request to add a dependency, the script aimed to bypass the developer’s scrutiny, relying on the AI’s speed and convenience to complete the installation before the user could intervene.

Forever Security’s monitoring tools detected the anomalous request during a real‑time analysis of the customer’s development environment. The firm’s sensors flagged the command as suspicious, halted the execution, and alerted the user, preventing the malicious package from reaching the local node_modules tree.

The episode underscores a growing concern among security researchers: as AI tools become more integrated into code creation, they also expand the attack surface for supply‑chain threats. Malicious actors are experimenting with “prompt injection” techniques that manipulate AI behavior, and hidden files in common directories like Downloads present a low‑effort vector for such attacks.

Experts advise developers to treat AI assistants as semi‑trusted collaborators rather than fully automated operators. Recommended practices include restricting the assistant’s ability to run shell commands, employing whitelists for approved npm packages, and maintaining vigilant monitoring of any file that could trigger automated actions.

Going forward, security firms anticipate a rise in similar attempts, prompting calls for tighter integration of threat‑detection capabilities within AI development tools themselves. Until such safeguards become standard, the onus remains on developers and organizations to implement layered defenses that can catch malicious instructions before they reach the codebase.