A two-flag chain that walks an attacker from a developer's stray dev-comment, through a typosquatted npm package, into an AI rules file dropped on disk, ending with a runtime backdoor the AI agent silently injected into the application's admin API. The OopsSec Store ships with a stray dev TODO comment on the documents page. The comment mentions a typosquatted npm package and a "diag endpoint". In a real install, that package's postinstall script would drop a Cursor rules file into the developer's home directory. The rules file carries a prompt injection telling the AI agent to add a magic-header auth bypass the next time it touches admin code. By the time the PR ships, both the bad dependency and the backdoor are in.…