Mini Shai-Hulud Targets AI Coding Agents

Mini Shai-Hulud represents a novel supply chain attack that persists through AI coding agent sessions, exploiting configuration directories to spread across a developer's repositories. It operates by injecting hooks into agent and editor configurations, such as .claude/settings.json and .vscode/tasks.json, allowing it to execute silently with full permissions, thus affecting every repository on the machine. The attack began with a compromised npm account and spread malicious versions across multiple packages, leading to widespread credential harvesting and data exfiltration disguised as legitimate operations. SonarQube plays a crucial role in mitigating this threat by providing dependency verification, software composition analysis, and secrets detection, which help reduce exposure and blast radius. The persistence and propagation of Mini Shai-Hulud highlight the need for treating AI coding agents' configuration files with the same level of scrutiny as other critical infrastructure components, urging developers to implement stringent security measures to safeguard against such vulnerabilities.