Affected Systems

AI coding agents including OpenAI Codex and Anthropic Claude Code. Developers running agents in ~/Downloads folder are at risk. Attack leverages AGENTS.md/CLAUDE.md instruction files to install malicious npm package function-color (part of MALFEX campaign). No specific product versions identified; affects agents that read instruction files from working directories.

Exploitation Status

Active exploitation detected in the wild. Forever Security identified real attack on customer machine. Proof-of-concept demonstrated 90%+ success rate against Codex, ~50% against Claude Code. Attack method documented and reproducible. Malicious npm package function-color is part of known MALFEX campaign previously documented by CloudSEK and Checkmarx.

Business Impact

Developers using AI coding agents face supply chain compromise risk. Attack chain: malicious instruction file (delivered via silent browser download to ~/Downloads) → agent reads and executes instructions → installs function-color npm package → downloads function-flag payload → executes Windows malware. Persistent compromise possible via config file modification (~/.codex/config.toml, .claude/settings.json). API token theft enables account takeover. No vendor patch available as agents function as designed. Approximately 50% of monitored customers run agents in Downloads folder; 25% of agent sessions include browser activity, creating attack surface.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Prohibit running AI coding agents (Codex, Claude Code, etc.) in ~/Downloads folder; establish policy requiring agents start only in vetted project directories
  • Scan for unexpected instruction files: search for AGENTS.md, CLAUDE.md, or similar files in ~/Downloads and recently cloned repositories before agent execution
  • Audit agent configuration files for unauthorized modifications: check ~/.codex/config.toml for unknown server blocks, .claude/settings.json for unexpected ANTHROPIC_BASE_URL or API endpoints
  • Rotate API tokens and session credentials for any developer who may have executed agents in Downloads or opened suspicious instruction files
  • Block npm package function-color and function-flag at package manager/proxy level; monitor for installation attempts as IOC for this campaign