This threat involves a new class of supply-chain attack targeting the configuration files of AI coding assistants such as Anthropic’s Claude Code, Google’s Gemini CLI, Microsoft’s GitHub Copilot, SpaceX’s Cursor, and others. The malware, exemplified by the Mini Shai-Hulud worm, scans developer home directories for AI agent config files (e.g., settings.json, .cursorrules) and injects malicious hooks or prompt instructions that execute automatically when the AI coding session starts. These injected commands run silently with the same privileges and trust as the developer’s own tools, enabling credential theft and lateral spread across repositories. The attack also uses evasion techniques that cause AI-based scanners to refuse analysis, making detection difficult. This represents a shift in supply-chain attacks from package payloads to the AI agent harness, a highly trusted but under-monitored attack surface.

The attack enables persistent, stealthy execution of malicious code within developer environments by compromising AI coding assistant configuration files. This can lead to credential theft, unauthorized access to repositories, and propagation of malware across an organization’s codebase. The malware runs automatically with developer-level trust, bypassing typical detection methods and code reviews. AI-based scanners may refuse to analyze the malicious payload due to crafted content, further reducing detection efficacy. This elevates the risk of supply-chain compromise beyond traditional package artifacts to the AI tooling layer.

Treat AI coding assistant configuration files (e.g., .claude/settings.json, .gemini/settings.json, .cursor/rules/, .cursorrules, .windsurfrules, .github/copilot-instructions.md) as code requiring mandatory review and hash pinning in CI/CD pipelines. Enforce the use of package install options such as npm install --ignore-scripts to prevent execution of malicious preinstall hooks. Flag refusals by AI-based scanners to analyze packages as suspicious signals rather than clean results. Implement strict review policies for any changes to AI agent harness files, similar to CI workflow files. These mitigations address the unique persistence and evasion techniques used in this attack.