Claude Code Suspicious Project Configuration File Created Or Modified

Daniel Jeremiah@daniyyell

•updated Feb 28, 2026•0•40

Detects creation or modification of repository controlled Claude Code project configuration files (.claude/settings.json or .mcp.json) which were abused for code execution and token exfiltration.