AI coding agent spawning npm install of function-color or from Downloads

Suraj A@cytech

•updated yesterday•6•0•9

Detects package manager installations or executions spawned by an AI coding agent (such as claude, codex, or cursor) involving specific indicators like the 'function-color' package or running out of a Downloads working directory.