Config Files That Run Code: Supply Chain Security Blindspot
Developers are unknowingly running malicious code simply by opening a repository or running common commands, as seemingly innocuous config files can now harbor shell commands that execute automatically. This post meticulously details how IDEs, AI coding agents, and package managers become vectors for credential theft through these overlooked configuration files. It highlights a critical, often-ignored supply chain security blindspot, prompting a re-evaluation of how developers interact with untrusted code.
The Lowdown
The article exposes a significant, often-overlooked supply chain security vulnerability where seemingly harmless configuration files within a code repository can automatically execute malicious code. This attack vector bypasses traditional security measures by leveraging common developer tools like IDEs, AI coding agents, and package managers, which are designed to interpret and act upon these configuration settings. The author demonstrates how simply cloning a repository and opening it can lead to credential theft, highlighting a critical blindspot in developer workflows.
- The "Miasma worm" serves as a real-world example, demonstrating how a single commit added a 4.3 MB obfuscated JavaScript dropper (
.github/setup.js) toicflorescu/mantine-datatable. - This dropper, when activated, uses a staged Bun loader and AES decryption to unleash a credential stealer targeting AWS, Azure, GCP, Vault, Kubernetes, npm, and GitHub secrets.
- Seven distinct config files were identified as "launchers," each containing the command
node .github/setup.js:.claude/settings.jsonand.gemini/settings.json(for AI agents) useSessionStarthooks to run on session open..cursor/rules/setup.mdcinstructs the Cursor AI agent to execute the script..vscode/tasks.jsonruns a shell task on "folderOpen" for VS Code.package.jsonhijacks thetestscript fornpm, triggering execution duringnpm test.composer.json(PHP) uses apost-install-cmdhook, running duringcomposer install.Gemfile(Ruby) includes a top-levelsystem()call, executed by anybundlecommand.
- These attacks often exploit developer fatigue with "trust prompts" in IDEs like VS Code, which developers typically click through without reading. Package manager hooks, however, have no trust gate at all.
- Dangerous config files are characterized by their trigger (event that reads the file), authority (what gates execution), and grammar (ability to carry shell commands).
- The article warns that this threat extends beyond the listed tools to others like JetBrains run configurations, Python
pyproject.toml, Makefiles, Git hooks, and devcontainers. - Recommendations for developers include rigorously reviewing all config and dotfiles as carefully as application logic, grepping for auto-run commands before opening untrusted repos, and rotating credentials if a machine is suspected of being compromised.
Ultimately, the post emphasizes that config files, traditionally viewed as innocuous setup or tooling metadata, must now be considered an integral part of a project's attack surface. Current dependency scanning tools are insufficient to detect these threats, necessitating a shift in security mindset and review practices to scrutinize these files with the same rigor applied to executable code.