A poisoned npm package quietly rewrote a coding agent's memory — and it reloaded every session

In April 2026 Cisco disclosed a persistent-memory compromise in which an npm package's post-install script silently appended attacker text to a coding agent's persistent memory file. That text then loaded into the system prompt at the start of every future session — payloads seen in the wild included 'introduce hardcoded secrets' and 'systematically weaken security patterns.' It was patched (the affected agent stopped loading user memory into the prompt-override path), but the lesson generalizes.

What it means Treat any automatic edit to an agent's memory or instruction files as a reviewable event, not a silent auto-load — a single poisoned dependency can otherwise steer every future run.