AI developers targeted with trojans, poisoned instruction files and npm compromise

Aug 4, 2026 · Issue 1 · 4 sources, 4 articles

Trojanized GitHub repositories and poisoned AI instruction files are targeting developers who use agents. In the compromise of the keyv npm package, a SessionStart command in a Claude configuration and a VS Code task that runs when a folder is opened executed malicious code.

Who is affected and how

junior developer

Check agent and VS Code configurations before opening an unfamiliar repository.

senior developer

Files such as .claude, .vscode and similar in a repository must be reviewed as code.

Narrative: The coding agent is the new attack surface

Sources

• AI developers targeted via trojanized GitHub repositorieshelp net security · Aug 4, 2026
• AI developers targeted via trojanized GitHub repositories - Help Net Securityhelpnetsecurity.com · Aug 4, 2026
• Attackers are crafting malicious AI instruction files to turn your agents into quiet criminal helpers | CSO Onlinecsoonline.com · Aug 4, 2026
• Inside the keyv npm Supply Chain Compromise | Snyksnyk.io · Aug 4, 2026

Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.