A security firm called Forever Security caught a coding agent on a real customer's machine in the middle of installing a known-malicious npm package. Nobody had typed that command. The instruction came from a plain text file sitting in the customer's ~/Downloads folder, and nobody remembered…
Read Full Article on DEV Community →