Config Files That Run Code: Supply Chain Security Blindspot
Summary
SafeDep highlights a supply chain security blindspot where config files can execute code automatically, triggering potential data or credential exposure. The post catalogs vectors across editors and package managers (e.g., VS Code, Claude Code, Gemini CLI, Cursor, npm, Composer, Bundler) and explains how trust prompts and execution gates can be bypassed. It calls for treating config surfaces as code in SDLC reviews, with guidance on detection and mitigations.