MaaFramework upstream commits installed malicious editor hooks

MaaFramework's September 24 source tree acquired a JavaScript bootstrapper in an unexpected place: the settings used by contributors' coding tools. The project provided an image-recognition framework for automating interactions and testing software. SafeDep found it among six established repositories receiving hooks for the credential-stealing Mini Shai-Hulud worm, with the nearest candidate trigger in this case being the project's Release workflow.

The retained checkout explains why the language of the project's main code was no protection against this change. MaaFramework advertised a C++ core and interfaces for several ecosystems, but .claude/settings.json instructed a coding session to start a Node.js program. A separate .vscode/tasks.json offered the same command as Environment Setup. The files traveled with the source regardless of which framework binding a contributor intended to work on.

The added setup script downloaded a suitable Bun runtime and launched the bundled .claude/index.js. Its platform selection covered Windows, macOS, and Linux. Comparing the archived payload with those in the other affected repositories produced an identical digest, linking the source additions without relying on a filename alone. The Claude session hook and the requested VS Code folder-open task were alternate entry points; execution still depended on the local tool, available runtime, and applicable trust controls.

The release-workflow association was based on timing, not proof that a published MaaFramework binary contained the implant. The captured evidence instead showed executable settings distributed through the upstream repository. No affected PyPI, npm, NuGet, or other packaged release was established by this investigation. That distinction kept the incident's scope on the compromised development checkout while leaving the number of workstations that actually ran its hooks unresolved.