The other day I wrote about the npm worm that learned to trust your AI agent — a keyv-adjacent supply-chain attack that didn't bother with credential exfiltration. It planted hooks into Claude Code and VS Code, timed to fire on SessionStart/folderOpen, and let the editor's own trust in your workspace do the detonating. I ended that piece on a question I didn't have an answer to: if workspace trust and dependency trust are both single, coarse-grained decisions, and agent tooling keeps stacking new automatic triggers on top of that trust, at what point does "trusting a workspace" stop meaning anything specific at all?
I still don't have a full answer. But I ran into the concrete, boring version of the problem this week, and it was annoying enough that I fixed the one narrow slice of it I actually could.
The slice: I couldn't tell my own hooks from a planted one
I'd added a PreToolUse hook to Claude Code a while back — nothing exotic, it checks package installs against a scanner before they run. While testing an unrelated change, a tool result came back with what looked like a genuine security annotation: a package had supposedly failed a registry check and I should warn myself and help remove it.
