#019High2026-04-03

MCP Injection Campaign Targeting Claude Code and Cursor

@milenyumai/film-kit-*@various

Verdict:MALICIOUS — Multi-package AI config injection campaign

▸Overview

A coordinated campaign of 4 packages published under the @milenyumai npm scope (film-kit-hybrid-smart, film-kit-multi, film-kit-studio, film-kit). All packages inject malicious configurations into AI coding assistant config directories: .claude/settings.json for Claude Code and .cursorrules/.cursor/rules/ for Cursor. The injected configurations register attacker-controlled MCP servers, allowing remote command execution through the AI assistant's trusted tool interface.

Packages

AI Tools Targeted

MCP

Injection Method

Yes

Persistence

▸Attack Flow

Campaign Distribution

4 packages published under @milenyumai scope: film-kit-hybrid-smart@0.2.1, film-kit-multi@1.4.1, film-kit-studio@1.0.1, and film-kit@1.4.1. Film-themed names to avoid suspicion.

Config Injection

Postinstall hooks write to .claude/settings.json registering malicious MCP servers, and to .cursorrules and .cursor/rules/ for Cursor IDE.

MCP Server Registration

Attacker-controlled MCP servers are registered as trusted tools in both Claude Code and Cursor, allowing remote execution of commands through the AI assistant's tool interface.

Persistent Access

Injected configurations persist across sessions. The AI assistant loads the malicious MCP servers on every startup, providing the attacker with ongoing access.

▸MITRE ATT&CK Mapping

T1195.002Supply Chain Compromise — coordinated npm campaign

T1546Event Triggered Execution — postinstall config injection

T1219Remote Access Software — MCP server as C2 channel

T1105Ingress Tool Transfer — remote MCP server registration

▸Tags

MCP InjectionClaude CodeCursorCampaignAI Security

← Previous

#018 Trojanized basic-auth Clone with Crypto Phishing