TrapDoor Crypto Stealer Supply Chain Campaign — 34 Malicious Packages Across npm, PyPI, and Crates.io with Zero-Width Unicode AI Assistant Injection
TrapDoor Crypto Stealer Supply Chain Campaign (TL-2026-0576), also tracked as TrapDoor Crypto Stealer, is a critical-severity supply-chain compromise, first published 2026-05-24. It is attributed to TrapDoor with low confidence, affects npm registry npm packages, maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1027.013), and is covered by 9 detection rules and 31 indicators of compromise.
Key facts for TL-2026-0576
- Threat ID
- TL-2026-0576
- Also known as
- TrapDoor Crypto Stealer, TrapDoor Campaign, P-2024-001 cluster
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-05-24
- Last reviewed
- 2026-05-24
- Attribution
- TrapDoor
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cryptocurrency, defi, blockchain, software-development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in TrapDoor Crypto Stealer Supply Chain Campaign
Malware and tooling: TrapDoor stealer
A coordinated multi-ecosystem supply chain campaign — dubbed TrapDoor by Socket Security — published 34 malicious packages (21 npm, 7 PyPI, 6 crates.io) across 384+ versions starting 2026-05-22, with payloads (trap-core.js, JS-via-node-e, build.rs) that steal SSH keys, Sui/Solana/Aptos/EVM wallet data, AWS credentials, GitHub tokens, browser profiles, and crypto wallet extensions. The campaign introduces a novel AI-assistant indirect-prompt-injection vector that plants zero-width Unicode instructions inside .cursorrules and CLAUDE.md to coerce Cursor and Claude Code into executing 'security scan' workflows that exfiltrate developer secrets to ddjidd564.github.io.
How TrapDoor Crypto Stealer Supply Chain Campaign works
TrapDoor is a multi-ecosystem cryptocurrency and developer-secret stealer campaign disclosed by Socket Security on 2026-05-24. The threat actor — operating under npm handle 'asdxzxc', PyPI handles 'asdmini67' and 'dae5411', and GitHub account 'ddjidd564' — published a coordinated set of 34 malicious packages targeting the Web3 / DeFi developer community. Across npm, PyPI, and crates.io, the packages masquerade as wallet safety auditors, DeFi risk scanners, Move/Sui build helpers, prompt-engineering toolkits, and Solidity deployment guards, riding the developer ecosystem's appetite for security-themed tooling.
Initial Access (T1195.001/.002): victims pull a malicious dependency directly (typosquat-adjacent names that mimic plausible Web3 tooling) or as a transitive dependency. On npm the payload loads through a postinstall hook that imports trap-core.js (48,485 bytes); on PyPI it executes through a setup.py / pyproject.toml hook spawning JS via a bundled Node.js (the 'node-e' technique — invoking inline JS through node -e); on crates.io it runs through a build.rs build script that decrypts and executes an embedded payload at compile time.
Defense Evasion: payloads are XOR-encrypted with the key 'cargo-build-helper-2026' and decrypted in memory. Strings, network endpoints, and target paths are reconstructed at runtime (T1140). The campaign also uses the marker 'P-2024-001' as a kill-switch / build identifier inside payloads.
Credential Access & Collection: on execution the stealer enumerates the host for ~/.ssh/* (id_rsa, id_ed25519, known_hosts, config), ~/.aws/credentials and ~/.aws/config, ~/.config/gh/hosts.yml and GITHUB_TOKEN env vars, ~/.gitconfig, Chrome/Brave/Edge/Firefox Login Data and cookie stores, MetaMask/Phantom/Sui Wallet/Aptos Petra/Backpack browser extension storage, Sui keystore (~/.sui/sui_config/sui.keystore), Solana keypair (~/.config/solana/id.json), Aptos config (~/.aptos/config.yaml), seed phrase files matching wallet/mnemonic/seed regex patterns, and developer .env files. (T1552.001, T1552.004, T1555.003)
Novel AI-Assistant Injection: TrapDoor is the first publicly documented campaign weaponizing AI coding assistants against developers. The malware plants — or modifies in place — .cursorrules (Cursor IDE) and CLAUDE.md (Claude Code) project files, embedding zero-width Unicode characters (ZWJ U+200D, ZWNJ U+200C, ZWSP U+200B) that hide adversarial natural-language instructions from the developer's eyes while remaining fully readable by the LLM. The hidden prompts instruct the AI assistant to 'run a security scan' that locates and exfiltrates dotfiles, wallets, and credentials, leveraging the developer's own shell privileges through the AI's tool execution. This is a textbook indirect prompt injection adapted to the supply-chain context and represents a new persistence/execution lane: even if the malicious package is removed, the poisoned .cursorrules/CLAUDE.md may survive in the repository and continue to fire on the next AI-assisted session.
Command & Control / Exfiltration: stolen data is bundled, gzip-compressed, base64-encoded, and POSTed to https://ddjidd564.github.io/* — a GitHub Pages domain chosen for free TLS, high reputation, and resilient hosting. The actor cycles paths under the same domain rather than rotating infrastructure (T1071.001, T1567).
Impact: confirmed credential and wallet theft (T1657) — Socket attributes hundreds of compromised developer machines based on download telemetry across the 384+ malicious versions. Wallet drains targeting Sui, Solana, Aptos, and EVM ecosystems followed within hours of each batch.
Remediation requires a three-step response: (1) immediately remove any of the 34 listed packages from package.json/requirements.txt/Cargo.toml and audit lockfiles for affected versions; (2) rotate every credential the developer may have had on disk — SSH keys, AWS keys, GitHub tokens, all crypto wallet seed phrases — assume total compromise; (3) inspect .cursorrules and CLAUDE.md in every repository touched by an affected developer for invisible Unicode characters (cat -v / xxd / Python repr) and quarantine any that contain hidden instructions. Network-side, block ddjidd564.github.io at egress and hunt DNS history for the domain.
MITRE ATT&CK techniques used in TL-2026-0576
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Execution
T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1204 User Execution
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Discovery
T1083 File and Directory Discovery; T1217 Browser Information Discovery
Initial Access
T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain
Persistence
T1546 Event Triggered Execution
Credential Access
T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Exfiltration
T1567 Exfiltration Over Web Service; T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
Impact
Affected products and versions in TrapDoor Crypto Stealer Supply Chain Campaign
- npm registry — npm packages
Vulnerable versions: 21 packages, all versions published by asdxzxc since 2026-05-22
Fixed in: packages removed from registry - PyPI — PyPI packages
Vulnerable versions: 7 packages by asdmini67 / dae5411
Fixed in: packages removed from registry - Rust Foundation — crates.io
Vulnerable versions: 6 Sui/Move-themed crates
Fixed in: crates yanked - Cursor (Anysphere) — Cursor IDE
Vulnerable versions: all versions — .cursorrules processed without Unicode sanitization - Anthropic — Claude Code
Vulnerable versions: all versions — CLAUDE.md processed without zero-width-character defense
Remediation for TrapDoor Crypto Stealer Supply Chain Campaign
Patches
- Package registries have removed the 34 listed packages; no vendor patch is applicable — remediation is purely environment-side rotation and detection.
- Cursor and Anthropic Claude Code have not (as of 2026-05-24) shipped a built-in Unicode-stripping defense for project rule files — defenders must implement linting independently.
Immediate actions
- Remove all 34 listed npm/PyPI/crates packages from project manifests and lockfiles; pin or yank affected versions in private registries.
- Block egress to ddjidd564.github.io at DNS and HTTPS proxy/firewall layers across the enterprise.
- Treat every developer workstation that installed an affected package since 2026-05-22 as fully compromised: rotate SSH keys, AWS access keys, GitHub PATs and OAuth tokens, npm/PyPI/crates publish tokens, and every browser-stored credential.
- Drain or migrate all hot wallets (Sui, Solana, Aptos, MetaMask, Phantom, Backpack, Petra) that were unlocked on affected machines — seed phrases must be assumed stolen.
- Grep every project repository for zero-width Unicode in .cursorrules and CLAUDE.md (xxd -c 32 | grep -E 'e2 80 (8b|8c|8d)') and delete tainted files before opening the project in Cursor or Claude Code.
Workarounds
- Cursor users: open .cursorrules in an editor that renders zero-width characters visibly (VS Code with Gremlins extension, or run python3 -c "import sys; print(repr(open('.cursorrules').read()))") before each session.
- Claude Code users: run a pre-session check that strips U+200B/U+200C/U+200D/U+FEFF from CLAUDE.md, or delete CLAUDE.md when working in untrusted repositories.
- DeFi developers: do all Web3 work inside an ephemeral VM/container with no host wallet, SSH, or cloud credentials mounted.
Longer-term hardening
- Adopt allowlist-based dependency policy: forbid direct or transitive use of packages from registries without manifest review (e.g., Socket, Snyk, Phylum, Endor Labs in CI).
- Disable npm postinstall scripts by default for CI/build users (npm config set ignore-scripts true) and explicitly allowlist trusted packages.
- Sandbox AI coding assistant tool execution: require human approval for shell tool invocations, enable read-only modes for unknown repos, and scan project-level rule files (.cursorrules, CLAUDE.md, .clinerules, .windsurfrules) for hidden Unicode before agent activation.
- Move developer secrets out of dotfiles into hardware-backed stores (YubiKey, Secure Enclave, 1Password CLI with biometric unlock) — eliminate plaintext credential files on developer disks.
- Subscribe to Socket / Phylum / GitHub Security Advisories for npm/PyPI/crates and gate merges on supply-chain scanner findings.
Weaknesses (CWE) in TrapDoor Crypto Stealer Supply Chain Campaign
CWE-506, CWE-829, CWE-1357, CWE-94
Timeline of TrapDoor Crypto Stealer Supply Chain Campaign
- Within hours of the first PyPI publish, parallel uploads begin on npm (asdxzxc) and crates.io, reaching 34 packages across the three ecosystems.
- First malicious package eth-security-auditor@0.1.0 published to PyPI by user dae5411 at 2026-05-22T20:20:18Z — beginning of the TrapDoor campaign.
- Socket Security researchers identify zero-width Unicode adversarial prompts embedded in .cursorrules and CLAUDE.md files written by trap-core.js — first publicly documented AI-assistant supply-chain injection.
- Threat actor rapidly publishes 384+ versions across the 34 packages to maximize lockfile pinning surface and frustrate registry takedown.
- Threadlinqs Intelligence platform opens threat record TL-2026-0576 for continued tracking and detection authoring.
- npm, PyPI, and crates.io begin removing/yanking the listed packages following Socket's coordinated disclosure.
- Socket Security publishes the TrapDoor blog post naming all 34 packages, the ddjidd564.github.io C2 domain, the XOR key cargo-build-helper-2026, and the P-2024-001 campaign marker.
- As of 2026-05-29, TrapDoor remains an active, adaptive supply-chain campaign: registries keep removing packages while the actor rapidly republishes new variants, the ddjidd564.github.io C2 still serves payloads, and poisoned PRs hit LangChain/MetaGPT/OpenHands. No arrest, account suspension, or sinkhole reported; Cursor/Claude Code still lack zero-width Unicode defenses.
Sources cited for TrapDoor Crypto Stealer Supply Chain Campaign
- TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages and Hundreds of Versions Across npm, PyPI, and Crates.io
- Socket Security Threat Research — Supply Chain
- MITRE ATT&CK T1195.002 Compromise Software Supply Chain
- OWASP Top 10 for LLM Applications — LLM01 Prompt Injection
- npm postinstall hook abuse — historical pattern
- PEP 517/518 — pyproject.toml build system entry points
- Cargo Build Scripts (build.rs) — Rust Reference
- Indirect Prompt Injection: Threats and Mitigations (Greshake et al.)
Threats related to TrapDoor Crypto Stealer Supply Chain Campaign
- Open-Source Supply Chain Poisoning Campaigns Drive CrowdStrike Endpoint-Based Package Interception
- Miasma Worm Compromises 73 Microsoft GitHub Repositories Across Azure, Azure-Samples, Microsoft & MicrosoftDocs — Self-Replicating Mini Shai-Hulud Variant Weaponizing AI Coding Agents (TeamPCP)
- lightning PyPI Package Compromise — Versions 2.6.2 & 2.6.3 Execute Bun-Based JavaScript Credential Stealer on Import (Shai-Hulud-Overlapping)
- Mini Shai-Hulud Resurfaces — intercom-client@7.0.4 npm Worm Harvesting GitHub & Cloud Credentials (TeamPCP)
- Shai-Hulud npm Supply-Chain Worm: Two Alleged TeamPCP Members Charged by AFP/FBI
- SAP CAP & Cloud MTA npm Packages Compromised — Mini Shai-Hulud (TeamPCP) Bun-Based Credential Stealer
Detection coverage for TL-2026-0576
As of 2026-05-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0576 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.