Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

A malicious instruction file in a developer's Downloads folder tried to trick an AI coding agent into installing a known-malicious npm package, security firm Forever Security reported last week. The company caught the attempt on a real customer's machine and stopped the agent before any code ran, but could not determine how the file got into the folder.