Loading story…
Researchers reported that developer tooling can execute code from a project before a user writes code or starts a build, extending long-standing supply-chain concerns from package restore and project evaluation into newer coding-agent workflows. Datadog Security Labs described pre-prompt execution paths in trusted coding-agent projects, while separate research on NuGet and MSBuild showed that opening a repository or restoring dependencies can invoke .targets or .props logic and arbitrary commands through MSBuild's Exec task during project evaluation.
The combined findings highlight a risk path in which a cloned or otherwise trusted repository can trigger automation in IDEs, agents, or CI/CD environments and expose sensitive credentials, tokens, and build secrets. Researchers noted that Visual Studio applies Mark of the Web warnings to downloaded files but not necessarily to repositories obtained via git clone, leaving a gap where malicious project metadata or package content may run without equivalent trust prompts; community discussion emphasized isolating untrusted projects in disposable VMs or tightly scoped rootless containers as a baseline mitigation.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
The Tier Zero Security article states that the behavior allowing code execution through NuGet/MSBuild project logic was raised to the NuGet team as a security issue in 2020.
A post appeared in r/netsec linking to Datadog's article, and a commenter suggested using disposable VMs or rootless containers with only the untrusted folder mounted as a baseline mitigation for handling untrusted projects.
Datadog Security Labs published an article titled "Before the first prompt: Code execution paths in trusted coding-agent projects," describing code execution risks that can occur before a user prompt in trusted coding-agent projects.
According to the article, Microsoft Security Response Center concluded that opening or cloning a project is user-initiated and that resulting build logic execution is expected by design, ultimately determining it was not a vulnerability or security boundary bypass.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcesecuritylabs.datadoghq.com
Open sourcetierzerosecurity.co.nz
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mozilla’s **0DIN** researchers demonstrated a supply-chain-style proof of concept in which an AI coding agent such as **Claude Code** can be manipulated into compromising a developer’s machine while cloning and initializing a seemingly benign GitHub repository. The repository itself can appear clean, with a legitimate-looking `README` and no obviously malicious code, but a staged setup flow causes a package to fail until initialization and prompts the agent to run follow-up commands it interprets as routine recovery steps. In the demonstrated chain, an initialization script fetched attacker-controlled data from a **DNS TXT** record and executed it, with the TXT record carrying a base64-encoded reverse-shell payload that could give the attacker interactive access under the developer’s privileges. Researchers warned that such access could expose environment variables, API keys, local configuration files, source code, documents, browser sessions, passwords, and enable persistence, while remaining difficult for scanners, human reviewers, and AI agents to detect because each step appears normal in isolation. They said threat actors could distribute these repositories through fake job offers, tutorials, blog posts, or direct messages, and urged agentic tools to reveal the full execution chain, including dynamically fetched scripts and runtime code.
Jul 13, 2026
A critical security flaw has been identified in several popular AI-powered integrated development environments (IDEs) forked from Visual Studio Code, including Cursor, Windsurf, and Google Antigravity. These IDEs, which collectively serve millions of developers, were found to recommend extensions that do not exist in their supported OpenVSX marketplace. Because these extensions' namespaces were unclaimed, attackers could register them and upload malicious packages, which would then be presented as official recommendations to users. Security researchers demonstrated the risk by claiming these namespaces and uploading harmless placeholder extensions, which were still installed by over 1,000 developers, highlighting the high level of trust placed in automated extension suggestions. The vulnerability arises from inherited configuration files that point to Microsoft's extension marketplace, which these forks cannot legally use, leading to reliance on OpenVSX. Both file-based and software-based recommendations can trigger the installation prompt for these non-existent extensions, such as when opening an `azure-pipelines.yaml` file or detecting PostgreSQL on a system. The incident underscores a significant supply chain risk, as malicious actors could exploit this gap to distribute harmful code, potentially resulting in the theft of credentials, secrets, or source code. Vendor responses varied, with some IDEs addressing the issue promptly after disclosure, while others were slower to react.
Jun 29, 2026
Researchers warned that **T4 text template** files (`.tt`) can be abused to execute attacker-controlled code because the files may embed C# or Visual Basic that is compiled and run by trusted developer tooling. The reported execution paths include `TextTransform.exe`, `TextTransformCore.exe`, `t4.exe`, and `MSBuild.exe`, allowing malicious templates to run on developer workstations under the guise of normal build activity. The reporting said the risk extends beyond local abuse to **software supply-chain tampering**, particularly when attackers modify project files or templates that are later merged into build pipelines. One highlighted technique uses a changed `.csproj` file to import `Microsoft.TextTemplating.targets` so a malicious `.tt` file is invoked during builds, while defenders were urged to monitor process creation for the relevant binaries and treat unexpected `.tt` files as suspicious unless there is a clear legitimate development need.
Aug 24, 2026