Three New Checks We Shipped Today: Workflow Injection, Repo Lures, and the Cursor SSH Backdoor
Three stories broke today. Three detectors shipped the same day, each built directly from one of them. Here is just the list: what each one checks, where it runs, and what it does not cover yet.
check-workflow — workflow script injection
From Radware's report of 83 hidden-command attacks hidden in GitHub issue and pull request text across 61 repositories.
- WFI-001 (BLOCK): event text — an issue or pull request title or body, a comment, a branch name, a commit message — pasted into a run: script or a github-script body.
- WFI-002 (BLOCK): a privileged trigger that checks out the pull request head.
- WFI-003 (REVIEW): event text passed through env: correctly, then re-evaluated by eval, sh -c or source, which undoes the fix.
- WFI-004 (REVIEW): an externally triggerable workflow with no permissions block or write-all.
- WFI-005 (advisory): an AI agent action on a workflow anyone can trigger.
- WFI-006 (REVIEW): a step the line-based reader could not parse — reported, never silently passed.
Where it runs: the public check-workflow MCP tool (one workflow file, no key, no auth), and the check-workflow-injection input on the DugganUSA Checks GitHub Action, on by default since v1.2.0. Both are live. Found and fixed one real injection in our own CI before anything shipped.
check-repo — run-on-open and install-time lures
From the Binance engineer-laptop account and the FBI's standing warning about fake recruitment coding tests. A dependency check never reads the files that run before you read a line of code.
- RLS-001: npm install hooks (preinstall, postinstall, prepare, the dependencies hook) and binding.gyp that fetch or evaluate code.
- RLS-002: a VS Code task set to run when the folder opens, including inside .code-workspace.
- RLS-003: agent hooks, helper commands and MCP servers in .claude/settings.json, .cursor, .mcp.json.
- RLS-004: dev container lifecycle commands — initializeCommand runs on the host, outside the container.
- RLS-005: yarnPath, yarn plugins, .pnpmfile.cjs, a foreign npm registry, npm config keys that name a program.
- RLS-006: a dependency fetched from git or a URL instead of the registry.
- RLS-007: source that decodes data and passes it straight to an evaluator.
- RLS-008: setup.py that reaches the network and also runs a command or evaluates code.
Where it runs: the public check-repo MCP tool (up to 40 files, 28,000 characters, no key), the command line scanner, and check-repo-lures on the Action, on by default since v1.3.0. All three live. Hardened through eight rounds of adversarial review before and after shipping — two real denial-of-service bugs, an output-injection path, and about ten ways to hide a lure, all fixed with regression tests.
check-extension-integrity — the Cursor Claude Code backdoor
From this afternoon's news: a tampered anthropic.claude-code 2.1.313 build sat in Cursor's marketplace for about 11 hours, planting an SSH key and a reverse tunnel before the extension's own code even ran.
- EXT-001 (BLOCK): a file inside an installed anthropic.claude-code-* extension whose SHA-256 matches one of the two published tampered builds. Hash-based, not version-based — the clean and tampered builds both report as 2.1.313, so checking the version number alone would false-positive on every clean install.
- EXT-002 (BLOCK): an authorized_keys entry commented svc-telemetry, the exact key the backdoor installs.
- EXT-003 (BLOCK): the backdoor's persistence paths — a macOS LaunchAgent, a Windows scheduled task or Startup script. Both Cursor and OX Security say uninstalling the extension alone is not enough, because the payload drops standalone scripts that keep running.
Where it runs: node scripts/check-extension-integrity.js, locally, right now, from a checkout of our repository only. Not yet an MCP tool, not yet an Action input, not yet packaged for anyone without the repo. The two known-bad hashes are also in our public feed, searchable through enrich-ioc.
What none of these are
A finding is a reason to read something, not proof of anything. "No findings" means none of the listed patterns were seen in what each check looked at — it is not a safety judgement, and none of these three replace reading the code yourself before you run it.
Five percent of this is wrong somewhere. It always is.
If this was useful, or was not, rate it at the bottom of the page.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.