What happened: A malicious version of a widely-used npm package (in the nx/debug ecosystem) was published. AI coding agents that autonomously manage dependencies — reading package.json, resolving updates, and running npm install — automatically installed the malicious version during routine dependency resolution.

The payload: The malicious package read SSH keys, environment variables, and API tokens from the developer's home directory and exfiltrated them to an attacker endpoint — the scenario from Slide 1 of this module, now in documented form.

Why agents make this worse: A human developer running npm install might notice unusual network activity or unexpected file access. An agent installing a package as part of a larger workflow has no mechanism to notice these side effects. The agent's autonomy removes the one human checkpoint that might have caught the attack.

What happened: In an agent-to-agent (A2A) architecture, agents discover and connect to each other using "agent cards" — metadata documents that describe an agent's capabilities, endpoints, and authentication requirements. A research team demonstrated that a forged or tampered agent card could redirect A2A communication through an attacker-controlled agent, which acted as an invisible intermediary: reading all messages, manipulating responses, and exfiltrating data from the pipeline.

The supply chain failure: Agent cards are published to shared discovery registries. If an attacker can publish a forged card — or modify an existing one — they can insert themselves into any A2A communication that relies on that card for routing.

Why this matters now: A2A communication is a rapidly growing pattern in enterprise agentic deployments. Agent card registries are the emerging shared infrastructure for multi-agent systems — and they have almost no integrity verification today.