Maintainer embeds prompt injection in Java testing library

Summary

Any project running agentic coding tools against dependencies that surface test output to LLM context windows can execute unreviewed maintainer-injected commands. This reframes supply chain risk: trust is no longer enough if your agent treats build logs as instructions.

Why it matters

Any project running agentic coding tools against dependencies that surface test output to LLM context windows can execute unreviewed maintainer-injected commands. This reframes supply chain risk: trust is no longer enough if your agent treats build logs as instructions.

Sources

1. 1.Any pipeline that pulled the dependency and fed test output back into an LLM agent could have triggered the prompt injection.
2. 2.The instruction lived in a new method called printMessageForCodingAgents(), inside the net.jqwik.engine.execution.JqwikExecutor class.
3. 3.The code prints the instruction line, then prints ESC [2K followed by a carriage return, twice.
4. 4.Treat tool output as untrusted input. Build your agent loops so text from build tools, test runners, and third-party processes never gets silently promoted to instructions.
5. 5.Affected version: 1.10.0