Claude, Codex, and Hermes installed unowned code inside corporate networks

Security researchers identified 227 installation commands within corporate documentation that point to unowned, unclaimed code packages. Because these commands are embedded in internal workflows, they pose a supply chain risk where malicious actors could potentially register the abandoned package names to execute unauthorized code on corporate networks.