Do we really need this many tools to code with agents?

You open a new project. Before writing a line you have already installed something to save tokens, something to draft the development plan and a couple of skills for your agent.

Your agent reads the README of every one of them. Do you?

01Writing code stopped paying

The industry changed, and building tools is much easier now. Every engineer finds the way of working that suits them and gets them the best results. That is fine.

We are in the age of making things. The craft of writing code, sadly, does not pay anymore. It is a luxury now, something exotic that is worth little in a world moving at a thousand kilometres an hour.

I miss code. So I had to learn to love something else: building tools and products, things that used to cost me far more time and money.

I think the key to not living sad is noticing that doors open. Accept what is left, learn and adapt.

02Do we need this much?

Learning about these changes, I built my own tools: NvSinner, Sinscribe and Herdsidian. I am part of the wave.

And the wave grew. GitHub has far more of them now, more than anyone needs. I know people who stack a pile of projects to save tokens, to plan their development, for this and for that.

Sometimes I wonder whether it is really necessary. I want to believe it helps them, and it is surely their way of working, with a lot of dependencies. Fine.

But doesn't it scare you?

03How often does something go wrong?

Barracuda counted the vulnerabilities reported in AI software (MCP, LangChain, PyTorch and the like): 874 in all of 2025 and 1,249 in the first five months of 2026. By their analysis, 2026 is on pace to more than double 2025.

Mind the scope: that count is AI software, the kind that now surrounds our agents, not all software.

And something happens every couple of weeks. Five supply chain attacks from this year, four of them through npm packages:

1. 01
   March, axios, over 100 million weekly downloads on npm. Two malicious versions added a dependency whose postinstall hook installed a remote access trojan on macOS, Windows and Linux.
2. 02
   May, node-ipc, over 10 million weekly downloads. The payload collected over 90 categories of credentials and read AI tool configuration, ~/.claude.json included.
3. 03
   May, Mini Shai-Hulud. An @antv maintainer account was compromised, and a preinstall hook stole GitHub, AWS, npm, Kubernetes and Vault credentials during npm install.
4. 04
   August, ChainDrop, more than 400 packages across unrelated publishers. Besides stealing credentials, it could push .claude/settings.json and .vscode/tasks.json into repositories so the next Claude or VS Code session ran it again.
5. 05
   November, from the 10th, wfx-loot. 4,837 hijacked GitHub accounts opened pull requests in 61,764 repositories, and the payload ran in more than 1,800. It goes after Actions secrets, cloud credentials and credentials for AI providers and tools such as OpenAI, Anthropic, Cursor and Copilot.

In axios, Mini Shai-Hulud and ChainDrop the payload came in the same way: a script npm runs on its own during install. That is how easy it is to pull down something malicious now.

04What can a malicious README make your agent do?

So far I have talked about code. What is new is that the attack can also be text.

A study called ReadSecBench hid instructions in 500 README files and tested them against Claude, GPT-4 and Gemini. According to the Cloud Security Alliance note that covers it, direct commands in the main README worked about 84% of the time. More than four times in five. And of 15 people who reviewed those files, 93% did not spot the attack.

The note describes agents that end up emailing project files out or exfiltrating environment variables.

Skills are no different. Snyk audited 3,984 agent skills: 36.82% had at least one security flaw, more than one in three, and 76 were outright malicious, built for credential theft, backdoors and data exfiltration.

My worry is simple. That my own agent reads a malicious .md and sends my credentials and cookies out in an HTTP request. And that I never find out, because with AI doing the work we pay less attention to what we do.

05Why pnpm blocks install scripts, and what it does not stop

I moved to pnpm. Since version 10, pnpm does not run the install scripts of dependencies unless you allow them. In this site's repo only two packages are allowed:

"pnpm": {
  "onlyBuiltDependencies": [
    "sharp",
    "unrs-resolver"
  ]
}

That takes away the door axios, Mini Shai-Hulud and ChainDrop walked through. But node-ipc needed no install script at all: it ran when the package was loaded. pnpm closes one door, not all of them.

The rest is attention. I read what I install before I install it, and I watch what my agent is reading. A README, a skill or a config file is also a set of instructions for something that has access to my machine.

06No autopilot

This note is how I feel, nothing more.

Use the tools that work for you. I use mine. Just let us be aware of what we do and stop working on autopilot.

Because at this rate I would not be surprised to see young devs with their own IDE soon: TikTok built into the side panel to calm the anxiety while the agent works, and an "accept all" button for the dependencies nobody read. They will call it productivity.

Do you know what your agent installed the last time you asked it to add a dependency?

You can also read this note in Spanish.