Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

A security firm discovered a malicious instruction file in a developer's Downloads folder that attempted to deceive an AI coding agent into installing a known malicious npm package. The firm detected and stopped the attempt on a customer's machine before any code was executed. The origin of the malicious file in the folder is unknown. The incident was reported by Forever Security in a recent publication. The company was able to intervene and prevent potential harm. The malicious file's presence in the Downloads folder suggests a potential vulnerability in the development environment.