pkg-inject: Scanning npm and PyPI Packages for Prompt-Injection Payloads Targeting AI Coding Assistants

pkg-inject is an open-source scanner that inspects npm and PyPI packages for prompt-injection payloads embedded in package metadata and documentation - content that AI coding assistants (GitHub Copilot, Cursor, Claude Code) read and may act upon. It addresses an emerging software supply-chain threat at the intersection of package security and large language model agents.