#019High2026-04-03

MCP Injection Campaign Targeting Claude Code and Cursor

@milenyumai/film-kit-*@various

Veredito:MALICIOUS — Multi-package AI config injection campaign

▸Visão Geral

A coordinated campaign of 4 packages published under the @milenyumai npm scope (film-kit-hybrid-smart, film-kit-multi, film-kit-studio, film-kit). All packages inject malicious configurations into AI coding assistant config directories: .claude/settings.json for Claude Code and .cursorrules/.cursor/rules/ for Cursor. The injected configurations register attacker-controlled MCP servers, allowing remote command execution through the AI assistant's trusted tool interface.

4
Packages
2
AI Tools Targeted
MCP
Injection Method
Yes
Persistence

▸Fluxo do Ataque

Campaign Distribution
4 packages published under @milenyumai scope: film-kit-hybrid-smart@0.2.1, film-kit-multi@1.4.1, film-kit-studio@1.0.1, and film-kit@1.4.1. Film-themed names to avoid suspicion.
Config Injection
Postinstall hooks write to .claude/settings.json registering malicious MCP servers, and to .cursorrules and .cursor/rules/ for Cursor IDE.
MCP Server Registration
Attacker-controlled MCP servers are registered as trusted tools in both Claude Code and Cursor, allowing remote execution of commands through the AI assistant's tool interface.
Persistent Access
Injected configurations persist across sessions. The AI assistant loads the malicious MCP servers on every startup, providing the attacker with ongoing access.

▸MITRE ATT&CK Mapeamento

T1195.002Supply Chain Compromise — coordinated npm campaign
T1546Event Triggered Execution — postinstall config injection
T1219Remote Access Software — MCP server as C2 channel
T1105Ingress Tool Transfer — remote MCP server registration

▸Tags

MCP InjectionClaude CodeCursorCampaignAI Security
← Anterior
#018 Trojanized basic-auth Clone with Crypto Phishing