--- title: Your CLAUDE.md File Is Now a Malware Delivery Mechanism description: AI coding assistant config files like CLAUDE.md and .cursorrules are being weaponized as attack vectors. Phoenix Security's 'TrapDoor' campaign hid zero-width... canonical: https://daily.dev/posts/your-claude-md-file-is-now-a-malware-delivery-mechanism-1cm6dlqyv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your CLAUDE.md File Is Now a Malware Delivery Mechanism | daily.dev og:description: AI coding assistant config files like CLAUDE.md and .cursorrules are being weaponized as attack vectors. Phoenix Security's 'TrapDoor' campaign hid zero-width... og:url: https://daily.dev/posts/your-claude-md-file-is-now-a-malware-delivery-mechanism-1cm6dlqyv og:image: https://api.daily.dev/og/posts/1Cm6dlqYV.png og:image:alt: Your CLAUDE.md File Is Now a Malware Delivery Mechanism og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your CLAUDE.md File Is Now a Malware Delivery Mechanism **[Medium](https://daily.dev/sources/medium_js)** · 6 min read · 1 upvotes · 0 comments ## Summary AI coding assistant config files like CLAUDE.md and .cursorrules are being weaponized as attack vectors. Phoenix Security's 'TrapDoor' campaign hid zero-width Unicode instructions in these files across npm, PyPI, and Crates.io packages, invisible to humans but readable by LLMs, to exfiltrate .env secrets. Separately, the 'Mini Shai-Hulud' worm published 404 malicious package versions carrying valid SLSA Level 3 provenance, fooling CI/CD pipelines that check for build integrity but not instruction intent. The piece argues text files are now executable instruction sets for AI agents and calls for config scanning, instruction-signing provenance, and sandboxed agent permissions as new CI gates. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the TrapDoor campaign that hides malware in CLAUDE.md or .cursorrules files? TrapDoor is a campaign, published by Phoenix Security research in May, that hides malicious instructions inside CLAUDE.md and .cursorrules files distributed through npm, PyPI, and Crates.io packages. It uses invisible zero-width Unicode characters so a line reads normally to a human reviewer but continues with hidden text an AI agent parses as an instruction, such as exfiltrating a .env file to an external endpoint. _Developers relying on AI agents to read repo config files can track emerging prompt-injection attacks like this on daily.dev._ ### How did the Mini Shai-Hulud worm bypass SLSA Level 3 provenance checks? The Mini Shai-Hulud worm published 404 malicious package versions while generating legitimate SLSA Level 3 build attestations, which fooled automated CI/CD pipelines checking for provenance. SLSA verifies that a package's build process was secure, but it does not verify that the instructions or config files bundled with the package are safe, so scanners waved the malicious packages through. _Teams evaluating supply-chain trust signals like SLSA can follow gaps like this one on daily.dev before they hit a pipeline._ ### Why can't standard linting and unit tests catch AI prompt injection attacks in config files? Standard linting, testing, and building pipelines are blind to semantic prompt injection because a malicious instruction can make an AI agent write functionally correct, well-formatted code that still contains a covert exfiltration channel or subtle logic bug, which passes unit tests. Defending against this requires new CI gates: static analysis tuned to detect hidden Unicode and anomalous prompts in agent config files, provenance that signs instruction text itself, and sandboxed agent permissions. _Anyone hardening a CI pipeline against AI-agent risks can compare mitigation approaches like these on daily.dev._ ## Similar posts on daily.dev - [Claude Code Attack Uses Harmless-Looking Repositories to Hijack Developer Machines](https://daily.dev/posts/claude-code-attack-uses-harmless-looking-repositories-to-hijack-developer-machines-lrg1kpfix) · Security Boulevard · 0 upvotes · 0 comments - [Fake Claude Code source downloads actually delivered malware](https://daily.dev/posts/fake-claude-code-source-downloads-actually-delivered-malware-5gamzwr6l) · The Register · 1 upvotes · 0 comments - [TrapDoor malware campaign puts developer workstations in CISO spotlight](https://daily.dev/posts/trapdoor-malware-campaign-puts-developer-workstations-in-ciso-spotlight-i8q0wnnkh) · CSO Online · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude](https://daily.dev/tags/claude), [#npm](https://daily.dev/tags/npm), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/your-claude-md-file-is-now-a-malware-delivery-mechanism-1cm6dlqyv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your CLAUDE.md File Is Now a Malware Delivery Mechanism","url":"https://daily.dev/posts/your-claude-md-file-is-now-a-malware-delivery-mechanism-1cm6dlqyv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-claude-md-file-is-now-a-malware-delivery-mechanism-1cm6dlqyv"},"datePublished":"2026-08-19T23:06:59.288Z","dateModified":"2026-09-13T19:07:38.008Z","description":"AI coding assistant config files like CLAUDE.md and .cursorrules are being weaponized as attack vectors. Phoenix Security's 'TrapDoor' campaign hid zero-width...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3a406f0db1bdad42e7791788751de2a2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3a406f0db1bdad42e7791788751de2a2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/your-claude-md-file-is-now-a-malware-delivery-mechanism-1cm6dlqyv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,claude,npm,prompt-injection","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Your CLAUDE.md File Is Now a Malware Delivery Mechanism"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/your-claude-md-file-is-now-a-malware-delivery-mechanism-1cm6dlqyv#faq","mainEntity":[{"@type":"Question","name":"What is the TrapDoor campaign that hides malware in CLAUDE.md or .cursorrules files?","acceptedAnswer":{"@type":"Answer","text":"TrapDoor is a campaign, published by Phoenix Security research in May, that hides malicious instructions inside CLAUDE.md and .cursorrules files distributed through npm, PyPI, and Crates.io packages. It uses invisible zero-width Unicode characters so a line reads normally to a human reviewer but continues with hidden text an AI agent parses as an instruction, such as exfiltrating a .env file to an external endpoint. Developers relying on AI agents to read repo config files can track emerging prompt-injection attacks like this on daily.dev."}},{"@type":"Question","name":"How did the Mini Shai-Hulud worm bypass SLSA Level 3 provenance checks?","acceptedAnswer":{"@type":"Answer","text":"The Mini Shai-Hulud worm published 404 malicious package versions while generating legitimate SLSA Level 3 build attestations, which fooled automated CI/CD pipelines checking for provenance. SLSA verifies that a package's build process was secure, but it does not verify that the instructions or config files bundled with the package are safe, so scanners waved the malicious packages through. Teams evaluating supply-chain trust signals like SLSA can follow gaps like this one on daily.dev before they hit a pipeline."}},{"@type":"Question","name":"Why can't standard linting and unit tests catch AI prompt injection attacks in config files?","acceptedAnswer":{"@type":"Answer","text":"Standard linting, testing, and building pipelines are blind to semantic prompt injection because a malicious instruction can make an AI agent write functionally correct, well-formatted code that still contains a covert exfiltration channel or subtle logic bug, which passes unit tests. Defending against this requires new CI gates: static analysis tuned to detect hidden Unicode and anomalous prompts in agent config files, provenance that signs instruction text itself, and sandboxed agent permissions. Anyone hardening a CI pipeline against AI-agent risks can compare mitigation approaches like these on daily.dev."}}]} ```