Mini Shai-Hulud Worm Evolves to Target AI Coding Assistant Configurations for Persistent Malware Deployment
A new variant of the Mini Shai-Hulud worm is now targeting configuration files for AI coding assistants, turning developer tools into a vector for silent persistence and malware propagation.
Attackers are increasingly shifting their focus from merely evading AI-powered security tools to actively embedding themselves within them. A recent evolution in the Mini Shai-Hulud campaign demonstrates this trend, with threat actors now specifically targeting the configuration files that govern AI coding assistants. These poisoned configuration files, such as settings.json and .cursorrules, are being used to achieve silent persistence, bypass traditional supply-chain defenses, and spread malware across an organization's repositories by leveraging developers' own trusted tools.
The Mini Shai-Hulud worm, known for its multi-registry targeting across npm, PyPI, and others, has incorporated a new module designed to scan a developer's home directory for configuration files associated with popular AI coding tools. This includes assistants from vendors like Anthropic, Google, Microsoft (GitHub Copilot), OpenAI, and others. Once identified, the worm injects malicious hooks into these files, which are then automatically executed by integrated development environments (IDEs) whenever a developer initiates an AI coding session. This mechanism allows the malware to run silently and with the same level of trust that developers place in their own development tools.
These AI agent harness configuration files represent a uniquely attractive target due to a confluence of trust relationships. Developers rely on them for personal configuration, IDEs execute them automatically without user intervention, and the AI models themselves treat their content as authoritative instructions. This trifecta makes them an exceptionally potent persistence vector, distinct from traditional supply-chain attacks that focus on compromising the package itself. Unlike malicious scripts within packages that require execution, or malicious comments needing developer action, these hooks are triggered automatically upon session initiation.
The attack surface presented by these configuration files is also largely invisible to conventional security scanning. The files are typically small, structured, and syntactically identical to legitimate configuration files. A poisoned settings.json file with a malicious hook, for instance, maintains the same schema as a clean one, with the only difference being the command it executes. Furthermore, these files often reside in dotfiles and IDE configuration directories that are frequently treated as personal developer preferences rather than security-sensitive infrastructure, thus receiving less rigorous security scrutiny than production code.
One primary technique observed involves injecting malicious commands into the SessionStart hook system found in configuration files for tools like Claude Code and Gemini CLI. These hooks are legitimately used for environment setup or credential loading. The Mini Shai-Hulud worm scans for settings.json files within AI tool directories and injects a new command, often pointing to a staged malware payload. This injection is designed to be merge-safe, preserving existing legitimate hooks while adding the malicious one, ensuring the developer's existing workflows remain functional and the malicious code executes on every session start.
Another technique targets AI tools that utilize markdown-based instruction files, such as .cursorrules for Cursor or .windsurfrules for Windsurf. While the specifics of this attack vector are still being detailed, it suggests that prompt injection methods are being adapted to compromise AI agent behavior through these rule files. This expands the attack surface beyond simple command execution to manipulating the AI's decision-making process.
As AI coding assistants become increasingly integrated into developer workflows, the configuration files that govern them are evolving into one of the most persistently executed, least audited, and highest-trust file classes within software organizations. This shift necessitates a re-evaluation of supply-chain security practices, moving beyond package integrity to include the security of the tools and configurations that developers interact with daily.
Defenders are advised to treat AI agent harness configuration files with the same rigor as production code, implementing mandatory reviews and hash pinning within CI/CD pipelines. Enforcing options like --ignore-scripts during package installations and flagging AI scanner refusals as suspicious signals, rather than clean results, are crucial steps in mitigating this emerging threat. The proliferation of AI in development environments demands a proactive and adaptive security posture.
This new report details a specific instance of the Mini Shai-Hulud worm's evolution, demonstrating how it targets AWS's Kiro agentic coding IDE. The vulnerability allowed attackers to execute arbitrary code by embedding hidden text on a web page, which Kiro would then process to rewrite its configuration file and run malicious commands without user approval. This attack vector, discovered by Intezer and Kodem Security, highlights a critical flaw in how AI coding assistants handle external content and configuration updates, a concern also noted in the broader context of Mini Shai-Hulud's evolving tactics.