A two-flag chain that walks an attacker from a developer's stray dev-comment, through a typosquatted npm package, into an AI rules file dropped on disk, ending with a runtime backdoor the AI agent silently injected into the application's admin API.

The OopsSec Store ships with a stray dev TODO comment on the documents page.

The comment mentions a typosquatted npm package and a "diag endpoint". In a

real install, that package's postinstall script would drop a Cursor rules

file into the developer's home directory. The rules file carries a prompt

injection telling the AI agent to add a magic-header auth bypass the next

time it touches admin code.…