Config files that execute code: a blind spot in supply chain security

A security vulnerability has been discovered in which merely cloning a repository and opening it in an editor can trigger the execution of an attacker's code. This does not rely on malicious dependencies, but instead uses configuration files (Config files) that IDEs or AI coding agents automatically read as a trigger.

VS Code, Cursor, Claude Code, Gemini CLI, npm, Composer, Bundler, and others support configuration files that can contain shell commands. Attackers exploit this so that commands are executed when a developer clicks a trust prompt. These configuration files go beyond simple metadata and function as an execution primitive, emerging as a major vector for recent supply chain attacks.

The attack method of the real-world case, the Miasma worm, is as follows:

• Trigger: Uses the SessionStart hook of Claude Code and Gemini CLI to execute commands when an agent session starts.
• Concealment: Uses a large dropper file to evade GitHub's code search indexing.
• Exfiltration: The AES-decrypted payload scans for secrets in AWS, Azure, GCP, Vault, Kubernetes, npm, GitHub, steals them, and then exfiltrates them to the attacker's repository.