A software team uses an AI coding agent to assist with development tasks — reviewing code, resolving dependencies, suggesting fixes. The agent has access to the project's terminal and can install packages on the developer's behalf.
A poisoned version of a popular npm package is published. It's signed. It passes automated security scans. The coding agent, following its normal workflow, installs it as a dependency update.
The package performs its advertised function. It also silently reads SSH keys and API tokens from the developer's home directory and exfiltrates them to an attacker-controlled endpoint. The agent did exactly what it was built to do — it just installed a package that had been compromised before it ever arrived.
The attacker didn't compromise the developer's environment. They compromised something the developer's agent would trust: a package in a registry the agent relied on. The attack happened upstream — before the agent ever ran. By the time the agent installed the package, the attack was already over.
This is what makes supply chain attacks against agentic systems so effective: they target trust before it can be questioned.
If the agent followed correct procedures, installed a signed package from a legitimate registry, and the package scans came back clean — where exactly did security fail?
That's what this module is about.