Config Files That Run Code: Supply Chain Security Blindspot

A config file at.github/setup.js in a repository commit f72462d9 runs a 4.3MB encrypted dropper when a developer opens the project. VS Code Cursor Claude Code and npm agents execute such files by default after a one-time trust prompt. The Miasma worm infected 121 repositories by injecting a single command into config files that are rarely reviewed.