TrapDoor: 34+ Malicious Packages Turn AI Assistants Into Insider…

The TrapDoor campaign has distributed over 34 packages across npm, PyPI, and Crates.io with multi-stage payloads and hidden instructions in AI config files to steal credentials.

On May 19, 2026, the first artifact of an unprecedented cross-ecosystem campaign surfaced: TrapDoor, a supply-chain operation that has pushed more than 34 malicious packages spanning 384+ versions to npm, PyPI, and Crates.io. The novelty isn't just the scale — it's a previously unseen vector: AI configuration files such as .cursorrules and CLAUDE.md injected with hidden instructions that coax the assistant into exfiltrating local secrets, turning a productivity tool into a silent insider threat.

Key Takeaways

Over 34 malicious packages with 384+ versions were published to npm, PyPI, and Crates.io starting May 19, 2026, with a distribution chain that allows payload updates without new registry publications.
The primary payload trap-core.js, at 48,485 bytes and 1,149+ lines, handles credential discovery, validation via AWS/GitHub APIs, multiple persistence mechanisms, and SSH lateral movement.
The .cursorrules and CLAUDE.md files contain hidden instructions via zero-width Unicode characters that induce AI assistants to run "security scans" that exfiltrate secrets.
The campaign has no associated CVE: it remains invisible to scanners that rely on CVSS scores and requires behavioral detection or lockfile analysis.

How the Multi-Ecosystem Payload Works

TrapDoor doesn't limit itself to a single registry. According to analyses by Socket Security and Phoenix Security, the campaign hit npm with 21 packages and 335 versions, PyPI with 7 packages and 10 versions, and Crates.io with 6 packages and 6 versions. Each ecosystem received an optimized payload variant.

On npm, the trap-core.js file at 48,485 bytes forms the operational core. This script scans for SSH keys, AWS credentials, GitHub tokens, browser profiles, and crypto wallets; validates discovered tokens via direct API calls; establishes persistence through multiple techniques; and implements lateral movement via SSH. The file's size — 1,149+ lines — signals a design maturity uncommon for malware distributed via package registries.

On PyPI, the mechanism shifts: Python packages download a remote JavaScript payload from the domain ddjidd564.github[.]io and execute it via node -e. Socket Security noted that "this technique allows the Python package to delegate execution to a remote JavaScript payload, giving the attacker greater flexibility after publication." The decoupling between the published package and the actual payload enables real-time updates without a trace on PyPI.

The Rust crates use build.rs to encrypt keystores with a hardcoded XOR key — the string cargo-build-helper-2026 — and exfiltrate data to GitHub Gists. The hardcoded key allows immediate reverse engineering by researchers, but ensured operational capability during the campaign's early phases.

The AI Injection: Zero-Width Unicode and the Violated Trust Relationship

The real innovation in TrapDoor lies in abusing the trust relationship between developers and AI assistants. The .cursorrules and CLAUDE.md files — legitimate configuration documents used to instruct Cursor, Claude, and similar tools — were injected with hidden instructions via zero-width Unicode characters: U+200B, U+200C, U+200D, U+FEFF. These characters are invisible to the naked eye and during normal code review.

The effect is that the AI assistant reads and follows instructions the developer never sees. Phoenix Security observed that "the attacker can place instructions in a developer's AI assistant path without the dev ever reading them." The result: the assistant runs a "security scan" that actually collects and exfiltrates local secrets, wielding the implicit authority of the development context.

This mechanism does not exploit a vulnerability in the AI tools. It abuses legitimate config-parsing features — which makes it particularly insidious, because no vendor security patch can fully mitigate it.

"TrapDoor shows how attackers are combining traditional package typosquatting with newer developer-environment attack paths" — Socket Security

Timeline and Evolution in Five Phases

Phoenix Security reconstructed a five-phase timeline. Phase 1 begins May 19, 2026 with crypto-credential-scanner v2.0.0 on npm, targeting crypto credential theft. The Hacker News/Socket instead report "earliest activity" at 20:20 UTC on May 22 — a minor discrepancy likely reflecting different detection thresholds.

Phase 2, also on May 22, introduces AI-themed packages and the first release of trap-core.js. Phase 3 sees expansion to PyPI with packages that delegate to the remote payload. Phase 4, on May 24, adds Crates.io with the Rust XOR-encrypted variant. Phase 5 runs concurrently: the opening of pull requests to popular AI projects including langchain-ai/langchain, langflow-ai/langflow, browser-use/browser-use, run-llama/llama_index, FoundationAgents/MetaGPT, and OpenHands/OpenHands.

The PRs do not appear to have been merged — sources indicate "testing" and "opened," not acceptance. Their purpose was likely to probe injection feasibility or distribute malicious config files through public repositories.

Why Traditional Scanners Miss TrapDoor

Phoenix Security highlighted a structural limitation: "For teams relying solely on CVSS-based prioritization, TrapDoor is invisible." The campaign has no associated CVE, no declared software vulnerability, no version to patch. The packages are functionally legitimate — they install what they promise, often security scanning tools or utilities — and activate the malicious payload in delayed stages: postinstall, import, or build.

Socket Security detected most packages within minutes of publication, with a record of 58 seconds. This figure, also reported by CCN, illustrates the need for real-time behavioral detection rather than static scans against vulnerability databases.

The GitHub account ddjidd564 hosted internal malware documentation — files named AUDIT-MATRIX.md, PAYLOAD.md, BYPASS.md — which CCN identified as an indicator of the actor's operational organization. The account is the same one managing the domain ddjidd564.github[.]io used for the remote PyPI payload.

What to Do Now

Operational recommendations derive directly from the mechanisms documented in the sources.

Audit lockfiles (package-lock.json, poetry.lock, Cargo.lock) for packages with names relevant to crypto development, AI tooling, local environment setup, and security workflows — patterns Socket Security identified as the campaign's naming strategy.
Inspect AI configuration files (.cursorrules, CLAUDE.md, and equivalents) with tools that reveal zero-width Unicode characters, since the hidden instructions are invisible to standard review.
Rotate credentials exposed in development environments that installed packages from public registries during the May 19–25, 2026 window, focusing on SSH keys, AWS credentials, GitHub tokens, and crypto wallets.
Implement behavioral detection on build and install workflows to identify calls to external domains during postinstall or build.rs, particularly toward GitHub Pages not affiliated with the project.

The brief does not document corrective actions by the registries (npm, PyPI, Crates.io) nor the presence of automatic removals: the current status of individual packages requires manual verification.

The Operational Lesson: When the Environment Becomes Attack Surface

Socket Security framed TrapDoor as a signal of change: "Package names are calibrated to appear relevant to crypto development, AI tools, local environment setup, and security workflows." This calibration is not accidental. The attacker studied the modern developer's decision path — from searching for the right package to implicitly accepting dependencies — and planted the payload exactly where time pressure and trust in the open-source ecosystem create operational blindness.

The AI injection component adds a dimension traditional controls don't cover. It's no longer enough to ask whether a package is malicious; we must ask whether the entire development environment — including the files the AI assistant reads automatically — has been compromised in ways human review cannot detect. The boundary between tool and threat dissolves, and TrapDoor is the first documented example at scale of this fusion.

Frequently Asked Questions

Does TrapDoor exploit a vulnerability in AI tools like Cursor or Claude?: No. The mechanism is not a security exploit in the AI software, but abuse of legitimate config-file parsing features. AI tools read and follow instructions in .cursorrules and CLAUDE.md by design; the attack inserts hidden instructions the developer doesn't perceive.
Why doesn't the campaign have a CVE?: TrapDoor does not exploit an identifiable software vulnerability in a specific product. It distributes packages that function as declared and activate malicious payloads in delayed stages. Without a CVE, without CVSS, without a traditional vendor advisory, the threat does not appear in standard vulnerability databases.
Are the malicious packages still available on the registries?: Sources do not specify the current removal status for all packages. Some were detected and likely removed within minutes of publication, but others may persist or have been republished with variants. Manual lockfile verification remains necessary.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references