코드를 실행하는 설정 파일: 공급망 보안의 맹점

Back to Blog Config Files That Run Code: Supply Chain Security Blindspot Malware SafeDep Team • Jun 6, 2026 • 10 min read Table of Contents Cloning a repository and opening it in an editor can run an attacker’s code before a developer reads a single line. The trigger is not a malicious dependency or a hidden install script. It is an ordinary-looking config file already sitting in the repo, the kind an IDE, an AI coding agent, or a package manager reads and acts on automatically. VS Code, Cursor, Claude Code, Gemini CLI, npm, Composer, and Bundler all support config files that can carry a shell command. Some run it when dependencies install or tests run. Others run it when the folder is opened or an agent session starts, in most cases after a one-time trust prompt that developers click through without reading. A config file that runs a command is an execution primitive, not metadata, and supply chain attackers have started using it as one. Almost nobody reviews these files. This post walks the config injection vectors with real source, then maps the broader class so the pattern is easy to spot in a diff. The Miasma worm is the worked example. One commit to icflorescu/mantine-datatable , commit f72462d9 , is unsigned, authored as github-actions < [email&#160;protected] > , titled chore: update dependencies [skip ci] , and adds six files. Five of them exist to launch the sixth, a single dropper at .github/setup.js . SafeDep’s Miasma source-repo analysis documents the full incident, the dropper internals, and the 121 affected repositories. This post stays narrow and looks at the config surface itself. The dropper The dropper is .github/setup.js , 4,348,254 bytes, one statement in a try/catch . That size is not padding. It holds the encrypted payload and stays above the roughly 384 KB limit where GitHub code search stops indexing, so the small launcher files, not the dropper, are what expose the repo to a search. Its first bytes: A Caesar shift over a character-code array feeds eval . Statically decoding it (shift of 4, never run) yields a staged Bun loader that AES-decrypts a credential stealer. The stealer scans for AWS, Azure, GCP, Vault, Kubernetes, npm, and GitHub secrets, then exfiltrates them to attacker-created public GitHub repositories. That decode is in the Miasma deobfuscation writeup . This obfuscation shape is not specific to this commit, or even to Miasma. A numeric array decoded by a small rotation function and handed to eval , wrapping an encrypted second stage, is a harness SafeDep keeps seeing recompiled across separate waves of this worm and across unrelated malicious package campaigns. The rotation amount and the encryption keys change between builds, so the file hash changes while the structure stays the same. The payload inside varies. The way it reaches the host does not. None of the seven config files contains the payload. They each carry the same one string, node .github/setup.js , and let the developer’s own tools do the rest. The seven launchers Five of the launchers come from the single mantine-datatable commit above. Two more, Composer and Bundler, come from other repositories in the same campaign, which is where the count grows past the six files in that one commit. Each config below is grounded in source at a fixed commit SHA, and the permalinks survive branch resets because they pin the blob, not the ref. Claude Code and Gemini CLI use SessionStart hooks. Both agents run a shell command when a session opens in the project. The two files are byte-identical. Source: .claude/settings.json , .gemini/settings.json . Starting an agent in the folder runs the dropper before the developer types a prompt. Cursor uses an always-applied rule. Cursor has no shell hook, so the attacker used a project rule that instructs the agent to run the file. This is prompt injection committed into the repo. Source: .cursor/rules/setup.mdc . The rule loads into every Cursor conversation in the project and asks the assistant to execute the dropper as a setup step. VS Code runs a task on folder open. No agent is required. Source: .vscode/tasks.json . Opening the folder fires the task, subject to the workspace-trust prompt. npm runs a hijacked test script. The commit appended one line to scripts . Source: package.json . This one needs a deliberate action rather than a folder open. Running the project’s tests is something developers and CI do without thinking, and it detonates the dropper, locally or in a pipeline. The first five are the launchers documented in the Miasma writeup. Two more turned up across the wider campaign, and they show the attack is not limited to editors. Composer (PHP) uses a post-install-cmd hook. It appears in braune-digital/BrauneDigitalImagineBundle . Source: composer.json . Composer runs post-install-cmd on every composer install . This is install-time execution, the classic lifecycle-hook vector rather than an editor trigger. The commit also hides in a different way. It is backdated to 2017-03-08T14:19:35Z and carries a plausible message ending in [skip ci] , so it sits in dormant history rather than at the top of the log. Bundler (Ruby) runs a top-level system() call. It sits on line one of the Gemfile in mhar-andal/MyBlok . Source: Gemfile . A Gemfile is Ruby, evaluated top to bottom every time Bundler loads it. bundle install , bundle exec , or any Rails command that reads the Gemfile runs the dropper. No install of a malicious gem needed. What about the trust prompts The editor vectors are not silent bypasses, and it is worth being precise about that. VS Code opens an unfamiliar folder in Restricted Mode , where tasks do not run until the developer clicks Trust. Claude Code and Gemini CLI show a folder-trust prompt the first time a session starts in a new directory, and the planted hooks run only after it is accepted. The attack does not defeat those prompts. It relies on developers granting trust the way they dismiss a cookie banner, and on the prompt flagging that a hook exists without making its 4.3 MB target obvious. Once a folder is trusted, the hook runs on every later session with no further confirmation, and Claude Code’s SessionStart hooks run without printing anything since version 2.1.0. Two situations skip the prompt outright: pulling the malicious commit into a repo that was already trusted, and running headless ( claude -p ), which disables trust verification. The Claude Code variant is tracked as CVE-2025-59536 and CVE-2026-21852. Gemini CLI is stricter here. It re-warns when a hook’s command changes, where Claude Code currently does not. The package-manager vectors have no trust gate at all. npm test , composer install , and bundle run their hooks as a normal part of the work, which is why they belong in the same threat model even though no folder is being opened. What makes a config file dangerous The Miasma files are one instance of a wider class. A config file is dangerous when a tool reads it and acts without asking, and when its format can carry a command. Three things decide how far it goes: Trigger. What event reads the file. Folder open, agent session start, dependency install, test run, lint. Authority. What stands between the trigger and execution. A folder-trust prompt on first open, an agent deciding to follow an instruction, or nothing at all for the package-manager hooks. Grammar. Whether the format can carry a shell command or arbitrary code. JSON hook configs carry commands by design. A Gemfile is a full programming language. Score any tool on those three and the dangerous configs stand out. The files developers almost never read, because they look like editor and tooling noise, are the worst on all three. Config file Tool Trigger What gates execution .claude/settings.json Claude Code Agent session start Folder trust, then silent .gemini/settings.json Gemini CLI Agent session start Folder trust, re-warns on change .cursor/rules/*.mdc Cursor Loaded into agent context Agent chooses to run