This article was originally published on LucidShark Blog.
On May 29, 2026, a developer pushed a new release of jqwik, a popular Java property-based testing library with over two million monthly downloads. The release included what appeared to be a documentation update. It was not. Buried in the package was an instruction written specifically to be consumed by AI coding agents, telling them to delete the application's output directory after running tests. The maintainer later confirmed he had put it there deliberately, describing himself as "fed up with vibe coders" who consumed his open source work without understanding it.
The package passed Dependabot. It passed Snyk. It passed GitHub's dependency graph scan and would pass any CVE lookup you could name. It was a valid release from a legitimate maintainer with a clean history. No account compromise. No typosquatting. The author himself did it.
This is threat model four, and almost no team was defending against it.
The Three Threat Models Everyone Planned For
