AI Code Helper Foiled by Hidden Malicious Script in Developer’s Downloads Folder

According to a report issued last week by security firm Forever Security, an ordinary file sitting in a programmer’s Downloads folder tried to persuade an AI‑driven coding assistant to fetch a known malicious npm package.

The event was observed in a live customer setup, where an instruction file—seemingly dropped into the developer’s default download path—held commands that would have instructed the AI agent to install a package from the public npm registry. That package has previously been identified in supply‑chain breaches for containing ransomware and credential‑stealing code.

AI coding assistants, capable of producing code snippets, recommending library imports, and even executing shell commands for the user, are now routine components of contemporary development pipelines. Because they can operate autonomously, any input they receive—be it a human prompt or a script—can be turned into immediate system actions, heightening the risk of malicious exploitation.

Here, the rogue file took advantage of the assistant’s default tendency to trust file‑based directives. By issuing what appeared to be a harmless request to add a dependency, the script sought to slip past the developer’s review, counting on the AI’s quickness and ease of use to finish the installation before any user could step in.

During a real‑time scan of the client’s development environment, Forever Security’s monitoring solution spotted the irregular request. Its sensors marked the command as suspicious, stopped its execution, and notified the user, thereby averting the malicious package’s entry into the local node_modules directory.

The incident highlights an escalating worry among security analysts: as AI utilities embed deeper into code production, they broaden the attack surface for supply‑chain threats. Threat actors are testing “prompt injection” methods to sway AI actions, and concealed files in ubiquitous folders such as Downloads offer a low‑effort pathway for these exploits.

Specialists recommend that developers view AI assistants as semi‑trusted partners instead of fully autonomous tools. Suggested safeguards involve limiting the assistant’s permission to run shell commands, using whitelists for vetted npm packages, and keeping close watch over any file that might trigger automated behavior.

Looking ahead, security vendors expect more of these attempts, urging tighter incorporation of threat‑detection features directly into AI development tools. Until such protections become commonplace, the responsibility lies with developers and organizations to deploy layered defenses that intercept malicious commands before they infiltrate the codebase.