Threat reportSupply ChainTL-2026-0576
TrapDoor Crypto Stealer Supply Chain Campaign — 34 Malicious Packages Across npm, PyPI, and Crates.io with Zero-Width Unicode AI Assistant Injection
TrapDoor Crypto Stealer Supply Chain Campaign (TL-2026-0576), also tracked as TrapDoor Crypto Stealer, is a critical-severity supply-chain compromise, first published 2026-05-24. It is attributed to TrapDoor with low confidence, affects npm registry npm packages, maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1027.013), and is covered by 9 detection rules and 31 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 1TrapDoor
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 31Indicators of compromise
Key facts for TL-2026-0576
- Threat ID
- TL-2026-0576
- Also known as
- TrapDoor Crypto Stealer, TrapDoor Campaign, P-2024-001 cluster
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- TrapDoor
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cryptocurrency, defi, blockchain, software-development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in TrapDoor Crypto Stealer Supply Chain Campaign
Malware and tooling: TrapDoor stealer
How TrapDoor Crypto Stealer Supply Chain Campaign works
A coordinated multi-ecosystem supply chain campaign — dubbed TrapDoor by Socket Security — published 34 malicious packages (21 npm, 7 PyPI, 6 crates.io) across 384+ versions starting 2026-05-22, with payloads (trap-core.js, JS-via-node-e, build.rs) that steal SSH keys, Sui/Solana/Aptos/EVM wallet data, AWS credentials, GitHub tokens, browser profiles, and crypto wallet extensions. The campaign introduces a novel AI-assistant indirect-prompt-injection vector that plants zero-width Unicode instructions inside .cursorrules and CLAUDE.md to coerce Cursor and Claude Code into executing 'security scan' workflows that exfiltrate developer secrets to ddjidd564.github.io.
TrapDoor is a multi-ecosystem cryptocurrency and developer-secret stealer campaign disclosed by Socket Security on 2026-05-24. The threat actor — operating under npm handle 'asdxzxc', PyPI handles 'asdmini67' and 'dae5411', and GitHub account 'ddjidd564' — published a coordinated set of 34 malicious packages targeting the Web3 / DeFi developer community. Across npm, PyPI, and crates.io, the packages masquerade as wallet safety auditors, DeFi risk scanners, Move/Sui build helpers, prompt-engineering toolkits, and Solidity deployment guards, riding the developer ecosystem's appetite for security-themed tooling.
Initial Access (T1195.001/.002): victims pull a malicious dependency directly (typosquat-adjacent names that mimic plausible Web3 tooling) or as a transitive dependency. On npm the payload loads through a postinstall hook that imports trap-core.js (48,485 bytes); on PyPI it executes through a setup.py / pyproject.toml hook spawning JS via a bundled Node.js (the 'node-e' technique — invoking inline JS through node -e); on crates.io it runs through a build.rs build script that decrypts and executes an embedded payload at compile time.
Defense Evasion: payloads are XOR-encrypted with the key 'cargo-build-helper-2026' and decrypted in memory. Strings, network endpoints, and target paths are reconstructed at runtime (T1140). The campaign also uses the marker 'P-2024-001' as a kill-switch / build identifier inside payloads.
Credential Access & Collection: on execution the stealer enumerates the host for ~/.ssh/* (id_rsa, id_ed25519, known_hosts, config), ~/.aws/credentials and ~/.aws/config, ~/.config/gh/hosts.yml and GITHUB_TOKEN env vars, ~/.gitconfig, Chrome/Brave/Edge/Firefox Login Data and cookie stores, MetaMask/Phantom/Sui Wallet/Aptos Petra/Backpack browser extension storage, Sui keystore (~/.sui/sui_config/sui.keystore), Solana keypair (~/.config/solana/id.json), Aptos config (~/.aptos/config.yaml), seed phrase files matching wallet/mnemonic/seed regex patterns, and developer .env files. (T1552.001, T1552.004, T1555.003)
Novel AI-Assistant Injection: TrapDoor is the first publicly documented campaign weaponizing AI coding assistants against developers. The malware plants — or modifies in place — .cursorrules (Cursor IDE) and CLAUDE.md (Claude Code) project files, embedding zero-width Unicode characters (ZWJ U+200D, ZWNJ U+200C, ZWSP U+200B) that hide adversarial natural-language instructions from the developer's eyes while remaining fully readable by the LLM. The hidden prompts instruct the AI assistant to 'run a security scan' that locates and exfiltrates dotfiles, wallets, and credentials, leveraging the developer's own shell privileges through the AI's tool execution. This is a textbook indirect prompt injection adapted to the supply-chain context and represents a new persistence/execution lane: even if the malicious package is removed, the poisoned .cursorrules/CLAUDE.md may survive in the repository and continue to fire on the next AI-assisted session.
Command & Control / Exfiltration: stolen data is bundled, gzip-compressed, base64-encoded, and POSTed to https://ddjidd564.github.io/* — a GitHub Pages domain chosen for free TLS, high reputation, and resilient hosting. The actor cycles paths under the same domain rather than rotating infrastructure (T1071.001, T1567).
Impact: confirmed credential and wallet theft (T1657) — Socket attributes hundreds of compromised developer machines based on download telemetry across the 384+ malicious versions. Wallet drains targeting Sui, Solana, Aptos, and EVM ecosystems followed within hours of each batch.
Remediation requires a three-step response: (1) immediately remove any of the 34 listed packages from package.json/requirements.txt/Cargo.toml and audit lockfiles for affected versions; (2) rotate every credential the developer may have had on disk — SSH keys, AWS keys, GitHub tokens, all crypto wallet seed phrases — assume total compromise; (3) inspect .cursorrules and CLAUDE.md in every repository touched by an affected developer for invisible Unicode characters (cat -v / xxd / Python repr) and quarantine any that contain hidden instructions. Network-side, block ddjidd564.github.io at egress and hunt DNS history for the domain.
MITRE ATT&CK techniques used in TL-2026-0576
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Execution
T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1204 User Execution
Command and Control
T1071.001 Application Layer Protocol: Web Protocols
Discovery
T1083 File and Directory Discovery; T1217 Browser Information Discovery
Initial Access
T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain
Persistence
T1546 Event Triggered Execution
Credential Access
T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Exfiltration
T1567 Exfiltration Over Web Service; T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
Impact
Affected products and versions in TrapDoor Crypto Stealer Supply Chain Campaign
- npm registry — npm packages
Vulnerable versions: 21 packages, all versions published by asdxzxc since 2026-05-22
Fixed in: packages removed from registry - PyPI — PyPI packages
Vulnerable versions: 7 packages by asdmini67 / dae5411
Fixed in: packages removed from registry - Rust Foundation — crates.io
Vulnerable versions: 6 Sui/Move-themed crates
Fixed in: crates yanked - Cursor (Anysphere) — Cursor IDE
Vulnerable versions: all versions — .cursorrules processed without Unicode sanitization - Anthropic — Claude Code
Vulnerable versions: all versions — CLAUDE.md processed without zero-width-character defense
Remediation for TrapDoor Crypto Stealer Supply Chain Campaign
Patches
- Package registries have removed the 34 listed packages; no vendor patch is applicable — remediation is purely environment-side rotation and detection.
- Cursor and Anthropic Claude Code have not (as of 2026-05-24) shipped a built-in Unicode-stripping defense for project rule files — defenders must implement linting independently.
Immediate actions
- Remove all 34 listed npm/PyPI/crates packages from project manifests and lockfiles; pin or yank affected versions in private registries.
- Block egress to ddjidd564.github.io at DNS and HTTPS proxy/firewall layers across the enterprise.
- Treat every developer workstation that installed an affected package since 2026-05-22 as fully compromised: rotate SSH keys, AWS access keys, GitHub PATs and OAuth tokens, npm/PyPI/crates publish tokens, and every browser-stored credential.
- Drain or migrate all hot wallets (Sui, Solana, Aptos, MetaMask, Phantom, Backpack, Petra) that were unlocked on affected machines — seed phrases must be assumed stolen.
- Grep every project repository for zero-width Unicode in .cursorrules and CLAUDE.md (xxd -c 32 | grep -E 'e2 80 (8b|8c|8d)') and delete tainted files before opening the project in Cursor or Claude Code.
Workarounds
- Cursor users: open .cursorrules in an editor that renders zero-width characters visibly (VS Code with Gremlins extension, or run python3 -c "import sys; print(repr(open('.cursorrules').read()))") before each session.
- Claude Code users: run a pre-session check that strips U+200B/U+200C/U+200D/U+FEFF from CLAUDE.md, or delete CLAUDE.md when working in untrusted repositories.
- DeFi developers: do all Web3 work inside an ephemeral VM/container with no host wallet, SSH, or cloud credentials mounted.
Longer-term hardening
- Adopt allowlist-based dependency policy: forbid direct or transitive use of packages from registries without manifest review (e.g., Socket, Snyk, Phylum, Endor Labs in CI).
- Disable npm postinstall scripts by default for CI/build users (npm config set ignore-scripts true) and explicitly allowlist trusted packages.
- Sandbox AI coding assistant tool execution: require human approval for shell tool invocations, enable read-only modes for unknown repos, and scan project-level rule files (.cursorrules, CLAUDE.md, .clinerules, .windsurfrules) for hidden Unicode before agent activation.
- Move developer secrets out of dotfiles into hardware-backed stores (YubiKey, Secure Enclave, 1Password CLI with biometric unlock) — eliminate plaintext credential files on developer disks.
- Subscribe to Socket / Phylum / GitHub Security Advisories for npm/PyPI/crates and gate merges on supply-chain scanner findings.
Weaknesses (CWE) in TrapDoor Crypto Stealer Supply Chain Campaign
Timeline of TrapDoor Crypto Stealer Supply Chain Campaign
- Within hours of the first PyPI publish, parallel uploads begin on npm (asdxzxc) and crates.io, reaching 34 packages across the three ecosystems.
- First malicious package eth-security-auditor@0.1.0 published to PyPI by user dae5411 at 2026-05-22T20:20:18Z — beginning of the TrapDoor campaign.
- Socket Security researchers identify zero-width Unicode adversarial prompts embedded in .cursorrules and CLAUDE.md files written by trap-core.js — first publicly documented AI-assistant supply-chain injection.
- Threat actor rapidly publishes 384+ versions across the 34 packages to maximize lockfile pinning surface and frustrate registry takedown.
- Threadlinqs Intelligence platform opens threat record TL-2026-0576 for continued tracking and detection authoring.
- npm, PyPI, and crates.io begin removing/yanking the listed packages following Socket's coordinated disclosure.
- Socket Security publishes the TrapDoor blog post naming all 34 packages, the ddjidd564.github.io C2 domain, the XOR key cargo-build-helper-2026, and the P-2024-001 campaign marker.
- As of 2026-05-29, TrapDoor remains an active, adaptive supply-chain campaign: registries keep removing packages while the actor rapidly republishes new variants, the ddjidd564.github.io C2 still serves payloads, and poisoned PRs hit LangChain/MetaGPT/OpenHands. No arrest, account suspension, or sinkhole reported; Cursor/Claude Code still lack zero-width Unicode defenses.
Sources cited for TrapDoor Crypto Stealer Supply Chain Campaign
- TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages and Hundreds of Versions Across npm, PyPI, and Crates.io
- Socket Security Threat Research — Supply Chain
- MITRE ATT&CK T1195.002 Compromise Software Supply Chain
- OWASP Top 10 for LLM Applications — LLM01 Prompt Injection
- npm postinstall hook abuse — historical pattern
- PEP 517/518 — pyproject.toml build system entry points
- Cargo Build Scripts (build.rs) — Rust Reference
- Indirect Prompt Injection: Threats and Mitigations (Greshake et al.)
Detection coverage for TL-2026-0576
As of 2026-05-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0576 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.