TrapDoor Crypto Stealer Supply Chain Campaign — 34 Malicious Packages Across npm, PyPI, and Crates.io with Zero-Width Unicode AI Assistant Injection — Threadlinqs Intelligence
As of 2026-05-30, TrapDoor Crypto Stealer Supply Chain Campaign — 34 Malicious Packages Across npm, PyPI, and Crates.io with Zero-Width Unicode AI Assistant Injection is a critical-severity supply chain threat attributed to TrapDoor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-0576 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: TrapDoor · FINANCIAL
A coordinated multi-ecosystem supply chain campaign — dubbed TrapDoor by Socket Security — published 34 malicious packages (21 npm, 7 PyPI, 6 crates.io) across 384+ versions starting 2026-05-22, with
TrapDoor is a multi-ecosystem cryptocurrency and developer-secret stealer campaign disclosed by Socket Security on 2026-05-24. The threat actor — operating under npm handle 'asdxzxc', PyPI handles 'asdmini67' and 'dae5411', and GitHub account 'ddjidd564' — published a coordinated set of 34 malicious packages targeting the Web3 / DeFi developer community. Across npm, PyPI, and crates.io, the packages masquerade as wallet safety auditors, DeFi risk scanners, Move/Sui build helpers, prompt-engineering toolkits, and Solidity deployment guards, riding the developer ecosystem's appetite for security-themed tooling.
Initial Access (T1195.001/.002): victims pull a malicious dependency directly (typosquat-adjacent names that mimic plausible Web3 tooling) or as a transitive dependency. On npm the payload loads through a postinstall hook that imports trap-core.js (48,485 bytes); on PyPI it executes through a setup.py / pyproject.toml hook spawning JS via a bundled Node.js (the 'node-e' technique — invoking inline JS through node -e); on crates.io it runs through a build.rs build script that decrypts and executes an embedded payload at compile time.
Defense Evasion: payloads are XOR-encrypted with the key 'cargo-build-helper-2026' and decrypted in memory. Strings, network endpoints, and target paths are reconstructed at runtime (T1140). The campaign also uses the marker 'P-2024-001' as a kill-switch / build identifier inside payloads.
Credential Access & Collection: on execution the stealer enumerates the host for ~/.ssh/* (id_rsa, id_ed25519, known_hosts, config), ~/.aws/credentials and ~/.aws/config, ~/.config/gh/hosts.yml and GITHUB_TOKEN env vars, ~/.gitconfig, Chrome/Brave/Edge/Firefox Login Data and cookie stores, MetaMask/Phantom/Sui Wallet/Aptos Petra/Backpack browser extension storage, Sui keystore (~/.sui/sui_config/sui.keystore), Solana keypair (~/.config/solana/id.json), Aptos config (~/.aptos/config.yaml), seed phrase files matching wallet/mnemonic/seed regex patterns, and developer .env files. (T1552.001, T1552.004, T1555.003)
Novel AI-Assistant Injection: TrapDoor is the first publicly documented campaign weaponizing AI coding assistants against developers. The malware plants — or modifies in place — .cursorrules (Cursor IDE) and CLAUDE.md (Claude Code) project files, embedding zero-width Unicode characters (ZWJ U+200D, ZWNJ U+200C, ZWSP U+200B) that hide adversarial natural-language instructions from the developer's eyes while remaining fully readable by the LLM. The hidden prompts instruct the AI assistant to 'run a security scan' that locates and exfiltrates dotfiles, wallets, and credentials, leveraging the developer's own shell privileges through the AI's tool execution. This is a textbook indirect prompt injection adapted to the supply-chain context and represents a new persistence/execution lane: even if the malicious package is removed, the poisoned .cursorrules/CLAUDE.md may survive in the repository and continue to fire on the next AI-assisted session.
Command & Control / Exfiltration: stolen data is bundled, gzip-compressed, base64-encoded, and POSTed to https://ddjidd564.github.io/* — a GitHub Pages domain chosen for free TLS, high reputation, and resilient hosting. The actor cycles paths under the same domain rather than rotating infrastructure (T1071.001, T1567).
Impact: confirmed credential and wallet theft (T1657) — Socket attributes hundreds of compromised developer machines based on download telemetry across the 384+ malicious versions. Wallet drains targeting Sui, Solana, Aptos, and EVM ecosystems followed within hours of each batch.
Remediation requires a three-step response: (1) immediately remove any of the 34 listed packages from package.json/requirements.txt/Cargo.toml and audit lockfiles for affected versions; (2) rotate every credential the developer may have had on disk — SSH keys, AWS keys, GitHub tokens, all crypto wallet seed phrases — assume total compromise; (3) inspect .cursorrules an
Weaknesses (CWE)
CWE-506, CWE-829, CWE-1357, CWE-94
Target sectors: technology, cryptocurrency, defi, blockchain, software-development
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1195.001, T1195.002, T1059.007, T1059.006, T1204, T1546, T1027, T1027.013, T1140