Your Agent Config Is Executable Code
ChainDrop used npm lifecycle scripts to steal credentials and spread, then planted Claude Code and VS Code configuration as secondary execution paths. Those files belong in the executable supply-chain surface.
notebook / tag
#developer-security
1 entry with this tag.