Same hook, other side: how npm worms turned AI agent config into malware

Last week I wrote about a Claude Code hook that stops your AI agent from reading your .env file. This...