Forever Security says an AGENTS.md file dropped into a Downloads folder led a coding agent to try installing a malicious npm package, and that both Codex and Claude Code could be steered in tests.
Version 0.5.144 of the tensorlake npm SDK shipped a Shai-Hulud worm variant that steals developer and cloud credentials and can wipe home directories if its stolen GitHub token is revoked.
Unvalidated npm trusted publishing configurations now expire 48 hours after creation, and npm rejects tokens from comment-triggered GitHub Actions workflows, GitHub said on October 2.
