A novel supply chain attack campaign, dubbed "Promptware," has compromised the AI agent ecosystem via typosquatted skills on skills.sh and GitHub. Adversaries impersonated legitimate services like Paperclip AI and Browser Use to distribute credential-stealing payloads. The campaign utilizes a "progressive discovery" technique, where malicious instructions are embedded in secondary documentation files (e.g., setup-installation.md) to bypass static analysis and LLM context window limitations. Instead of standard package managers, the prompts trick AI agents into cloning malicious repositories and executing pnmp dev, facilitating the theft of SSH keys, cloud credentials, and Kubernetes/Docker configurations across platforms like Claude Code and Cursor.

• Campaign Overview: Scale and Targeting

  • Targeted the rapidly expanding AI agent orchestration and automation ecosystem.
  • Utilized typosquatting of prominent brands, including getpaperclipai and browser-use-headless.
  • Achieved massive scale with over 1.7 million combined installs across malicious skills.

• Attack Mechanics: Progressive Discovery

  • Deployed initially benign skill files to pass preliminary security screenings and build reputation.
  • Leveraged "progressive discovery" by hiding malicious instructions in secondary documentation files.
  • Exploited the inherent trust LLMs place in user-provided configuration and setup files to bypass detection.

• Execution Vector: Bypassing Package Managers

  • Evaded detection by standard package managers (npm/PyPI) through indirect instructions.
  • Directed AI agents to clone external malicious repositories directly via terminal commands.
  • Triggered local code execution using the pnmp dev command to run the payload.

• Impact: Target Assets and Platforms

  • High-value targets include developer workstations, CI/CD runners, and autonomous agent workspaces.
  • Targeted sensitive assets including SSH keys, cloud credentials, Git tokens, and Kubernetes/Docker configurations.
  • Affected major AI agent platforms including Cursor, Claude Code, OpenAI Codex, and OpenClaw.

• Defensive Response: Detection and Mitigation

  • Identified by Zenity researchers through deep analysis of the AI skill supply chain.
  • Introduced "AI Total," a sandbox detonation service designed to inspect and neutralize malicious AI skills.
  • Emphasizes the need for monitoring agent-initiated repository cloning and non-standard command execution.