🔧 The npm Worm That Learned to Trust Your AI Agent

Your editor's autopilot is now part of your attack surface


Here's the part that should stop you mid-scroll: this isn't just another npm worm harvesting .env files. It's a worm that plants hooks in Claude Code and VS Code, waiting for the moment you trust a workspace, so it can execute without you doing anything else stupid. That's a new kind of...