Everybody's shipping code they can't read

This advisory reports a supply-chain malware campaign where an attacker republished 141 packages in an AI-agent package ecosystem, using a look‑alike dependency with an install-time script to deploy a payload that harvested browser cryptocurrency wallets and persisted across macOS, Windows, and Linux; it warns that AI coding agents increase the risk of malicious or spoofed package installs and recommends blocking known-malicious packages and making install scripts opt-in.