Hackers hijacked the npm account of the Axios package, a JavaScript HTTP client with 100M+ weekly downloads, to deliver remote access trojans to Linux, Windows, and macOS systems. One malicious ...
Agent searches GitHub → reads 10 SKILL.md files → compares them → picks one = ~50,000 tokens burned per skill lookup No registration required for reading. No API key needed for search or fetching ...