October 31st was the best day my product ever had. I launched Local Commander on Product Hunt, and it got the biggest response of its short life.
That afternoon I couldn't log into npm.
npm is the public catalogue developers install software from. It's how people installed my product. The password didn't work. I hit "reset" and no email arrived. I wrote to support. Silence.
Odd, but these things happen. The launch mattered more.
The second account
On November 1st I needed to ship updates. The old account was dead, support was silent. So I created a new one. Obvious move: the door's jammed, use another door.
On November 3rd the publishing token on the new account vanished. By itself. At that point I understood nothing. I moved the package to GitLab, just so people could still install it.
Not one email explaining anything. Not from npm, not from GitHub.
The email
The night of November 3rd a user writes. Kaspersky on his work computer has deleted a file from my program as a trojan. And GitHub's advisory database lists my package as malware. His question: is the version we run safe?
That's when it came together.
Kaspersky had already deleted my file on the same machine on October 23rd. I'd called it a fluke. Kaspersky had also complained about my other product. I hadn't connected that either. The account, the token, the antivirus: for three days I'd treated them as three unrelated glitches.
What it looked like from outside
Now look at what I did through someone else's eyes.
A package gets flagged as malware. Its author loses the account. He immediately opens a new one. The package resurfaces in another registry.
That's not the story of an honest developer. That's the textbook for real malware authors.
What I actually had was confusion. I wasn't covering my tracks. I didn't know there were any.
Where they came from
A week before launch, my AI and I built a handy little feature in one evening. The program looked into Claude's and Codex's working files on the user's computer and counted how many tokens the models had used. No text, just numbers. It worked great.
That feature shipped in exactly the version npm later removed. npm never gave a reason. But there was nothing else new in that version.
Now look at it the way an automated scanner does: a program reaches into another AI tool's files and sends something to its own server. That is precisely what session theft looks like.
Kaspersky is a separate story. A small helper inside the program started tasks hidden and "frozen", so that when you say stop, everything the task launched is guaranteed to stop. To an antivirus that looks like code injection. Antivirus judges behavior, not intentions.
None of these decisions was about harm. Each one was about convenience. Together they drew a portrait of a virus.
Why this wouldn't happen in a corporation
For twenty years I ran IT in banks and insurance companies. There, a feature like that would have gone through a security review, privacy lawyers and an architecture board. A week, maybe two. It drove me mad my whole career.
With AI: one evening. No boards.
Now I see those brakes weren't bureaucracy. They were other people's past crashes, written down as rules. A solo founder with AI gets startup speed and loses the corporate brakes. And finds out mid-air.
What I did once I understood
From corporate life I kept one rule for days like this: hide nothing. People should hear about the problem from you first, not from their antivirus.
On November 4th:
- Confirmed the deleted file was my original, not a tampered copy. Rebuilt it from source and got the same file.
- Sent everything to Kaspersky, ESET and Avast/AVG/Norton. Kaspersky's database now lists the file as clean.
- Released a version without the virus-like behavior. Stopping tasks works as before.
- Removing the token counting entirely. If someone wants those numbers, Claude and Codex can send them on their own, when the user tells them to. My program no longer looks into anyone else's files.
- Wrote to users personally: what happened, who's affected, what to do. Plus a block of facts they can verify themselves, or hand to their own AI to check.
- Published a page with the details and an open description of exactly what the program does on your computer.
- Not opening new npm accounts. I'm waiting to hear about the old ones; until then the program lives on GitLab. And I say so plainly instead of pretending it was the plan all along.
All of that took one day and most of a week's Claude and Codex subscription. What it would have cost before AI is a separate story.
A question
You get locked out with no explanation. The account won't open, support is silent, nobody tells you why.
What do you do first?
I opened a new account. Turns out that was the most suspicious thing I could have done.
More to come: why antivirus sees a trojan in an honest program, and what an incident like this would have cost a company before AI.
Top comments (0)