init-claude-code-statusline

This JSON by itself is not an explicit malware payload but constitutes a high-risk execution vector: it instructs the consumer to run a local shell script from a relative, hidden path without integrity or provenance checks. The main threat is supply-chain tampering or local file replacement leading to arbitrary code execution and potential data exfiltration. Recommend auditing the .claude/statusline.sh contents and provenance, enforcing integrity checks (hash/signature), using absolute vetted binaries or sandboxed execution, and restricting which directories may contain executable scripts.