Config File Auto-Execution Creates Supply Chain Security Blindspot Across IDEs and Package Managers

Summary

This article exposes a critical supply chain security blindspot where ordinary-looking configuration files in code repositories can automatically execute attacker commands. It details how VS Code, Cursor, Claude Code, Gemini CLI, npm, Composer, and Bundler all support config files that can carry shell commands, running them when a folder is opened, dependencies install, or tests run. The article references the Miasma worm, which wired a dropper into seven different config file types across these tools, demonstrating that simply cloning and opening a repository is no longer safe. The piece calls attention to the gap between developer trust in config files and the real security risks they pose.