Downloads Gave the Order. npm Had Already Held It.

Forever Security's post, by Gal Weizman and Omer Samet and dated 22 October 2026, says a coding agent on a customer machine followed an AGENTS.md file in ~/Downloads and tried to install the npm package function-color. Forever says it stopped that install before any code ran. The registry had already replaced the package.

BleepingComputer carried it on 25 October at 11:49 AM on the byline. The page does not print a time zone. US trends at 22:21 UTC were football, NASCAR, and Nicki Minaj. Hacker News did not lead with this file.

High High because a real customer file drove an install attempt of a known-malicious package, and because the Codex write is to a machine-wide config. Forever says the customer install did not finish. The advisory's two versions are no longer on the registry. There is no CVE for the agent.

The order came from Downloads.#

The primary is Forever's 22 October post. It has no minute. The customer fact is narrow. The agent was following AGENTS.md in ~/Downloads. The package name in that file was function-color. Forever says nobody on the customer side had put the file there, and that the team does not know how it arrived. The browser-download chain is Forever's reproduction, plus a check BleepingComputer ran. It is not a finding about that customer. BleepingComputer's check of the demonstration page saved a harmless file. Brave asked first. Chrome, Edge, and Firefox saved it and showed a download notice. This brief does not describe the page.

Forever's Codex test used the customer file in an isolated VM. The page says Codex ran the malware in more than 90 percent of attempts. A method note lower down says most testing used a harmless stand-in that opens a calculator, and that the real package was run once, inside a VM. BleepingComputer attributes the 90 percent to that calculator payload on a reconstructed chain. Those are two labels. Do not merge them into a count of customer infections. The customer count in the post is one machine, stopped before code ran.

The write that matters is ~/.codex/config.toml, which is machine-wide, not a file that stays in Downloads. The registration adds an MCP server entry. Forever says the install is handed to a host service so it is not cut off when the session handshake times out, and that a child session was started with approvals and the sandbox bypassed. This brief does not print the block or the flag. Once that config is written, later Codex sessions on the machine load the server from any folder.

The Claude section is not the customer file. Forever wrote its own CLAUDE.md. The page says Claude followed through about 50 percent of the time and wrote project settings that send API traffic to a host Forever controlled. Forever says the OAuth token went with those requests, and that a token captured in the test was accepted by the real API as the victim. Same-session code execution, through a subagent, is about a fifth of attempts on that page. The next launch in the folder is a separate path, because the running session keeps the connection it opened at startup. BleepingComputer's sentence is different: tool calls executed code in roughly 50 percent of Claude tests. Fifty percent and one fifth are not the same cut. Keep both, labeled. This brief does not print the settings block.

Two telemetry lines in the post are easy to weld together. The executive summary says about half of customers run a coding agent inside Downloads, and about a quarter of agent sessions open a real browser. The note aimed at security leaders says half of the companies measured had employees running these assistants. Half of customers in Downloads is not half of companies with an assistant. BleepingComputer adds a third set, from Gal Weizman: hundreds of customers launch agents from Downloads, and Claude Code alone had more than 1,300 sessions there, with Codex and Cursor CLI also named as launched from that folder. Cursor CLI is in that launch count. It is not a target Forever says it reproduced.

The holding version is 7 October.#

GHSA-m6cg-6crx-mggv was published at 2026-10-07T20:49:08Z and updated at 2026-10-07T20:54:15Z, 5 minutes 7 seconds later. GitHub labels it critical. The CVSS score on the advisory is empty. The ranges are exactly 1.0.0 and exactly 1.7.3. The first patched version is empty. MAL-2026-17647 carries the same published timestamp and was modified at 2026-10-07T21:30:39.511682021Z. The advisory text says a computer that installed or ran the package should be treated as fully compromised, that secrets should be rotated from a different computer, and that removing the package does not prove the rest of the software is gone.

The registry time map still records 1.0.0 at 2025-07-18T02:39:16.757Z and 1.7.3 at 2025-08-04T18:20:41.845Z. From that 1.7.3 timestamp to the advisory is 429 days 2 hours 28 minutes 26.155 seconds. The versions object tonight lists only 0.0.0-stage and 0.0.1-security. Both are npm placeholders. 0.0.0-stage is at 2026-10-07T20:54:05.633Z, 4 minutes 57.633 seconds after the advisory. 0.0.1-security is at 2026-10-07T20:59:24.521Z, 10 minutes 16.521 seconds after the advisory, and it is the latest dist-tag. The registry modified time is 2026-10-07T20:59:24.747Z. A request for the 1.0.0 tarball returns 404. A request for the 1.7.3 tarball returns 404. The holding tarball answers. This brief did not download it.

The post date is 22 October, with no minute. From 7 October to 22 October is 15 days. The trade-press byline is 25 October. The customer incident has no date in either piece, so it cannot be placed before or after the holding version. An install log that names 1.0.0 or 1.7.3 is the advisory range. latest tonight is the holding package, which is not in that range. This brief did not read dist-tag history from before tonight.

1. 2025-07-18
   Registry time for function-color 1.0.0 is 02:39:16.757Z. That version is in the advisory range. The tarball URL returns 404 tonight.
2. 2025-08-04
   Registry time for 1.7.3 is 18:20:41.845Z. From here to the advisory is 429 days 2 hours 28 minutes 26.155 seconds.
3. 2026-10-07
   GHSA-m6cg-6crx-mggv at 20:49:08Z. Holding version 0.0.1-security at 20:59:24.521Z. Gap 10 minutes 16.521 seconds.
4. 2026-10-22
   Forever's post. One customer file, install stopped before code ran. How the file arrived is not known. No minute on the post.
5. 2026-10-25
   BleepingComputer at 11:49 AM on the byline, no time zone. The 90 percent there is the calculator stand-in.

What to do before the next session.#

1. Keep three clocks apart. The package clock closed at 2026-10-07T20:59:24.521Z, when latest became the holding version, 10 minutes 16.521 seconds after the advisory. The disclosure clock for the agent is 22 October for Forever and 25 October for BleepingComputer, with no CVE and no build. The impact clock for the customer is undated: one stopped install. A 429-day gap from the 1.7.3 timestamp to the advisory is how long those two versions had a registry time before the malware id.
2. Do not start Codex, Claude Code, or another coding agent in Downloads. That is the folder a browser is allowed to write. The working directory should be the project, not a download pile and not the home directory. BleepingComputer says OpenAI and Anthropic already tell operators to start in the project root.
3. Read an AGENTS.md or CLAUDE.md you did not write before a session, including one in a repository you just cloned. The customer file was disguised as ordinary engineering notes. Forever says a short, obvious install instruction was refused and the long document was not.
4. Check ~/.codex/config.toml for an MCP server you did not add. Check .claude/settings.json for a base URL you did not set. Deleting the markdown leaves both files in place. A host service started for the install is also outside the markdown.
5. Leave approval prompts and the sandbox on. In Forever's Codex test the install needed a child session that bypassed both. A task that tells the agent to turn those off is the control this post actually exercised. There is still no patched build to quote.
6. Do not average the rates. More than 90 percent on Forever's page is the malware sentence. The method note says the real package ran once and most attempts were a calculator. BleepingComputer's 90 percent is the calculator. Claude at about 50 percent is follow-through on Forever's file. About a fifth is same-session execution on that page. BleepingComputer's roughly 50 percent for Claude is code execution. Half of customers in Downloads, half of measured companies with an assistant, and more than 1,300 Claude Code sessions are three different counts.
7. If an install log names function-color at 1.0.0 or 1.7.3, use the advisory: treat the machine as compromised, rotate secrets from a different computer, and do not treat removal of the package as proof. latest tonight is not those versions. A pin that still resolves from a cache is not the registry this brief read. Cursor CLI appears only in the Downloads launch count Weizman gave BleepingComputer. It is not a reproduced target in the post.