# TrapDoor Crypto Stealer Supply Chain Campaign — 34 Malicious Packages Across npm, PyPI, and Crates.io with Zero-Width Unicode AI Assistant Injection

> A coordinated multi-ecosystem supply chain campaign — dubbed TrapDoor by Socket Security — published 34 malicious packages (21 npm, 7 PyPI, 6 crates.io) across 384+ versions starting 2026-05-22, with payloads (trap-core.js, JS-via-node-e, build.rs) that steal SSH keys, Sui/Solana/Aptos/EVM wallet data, AWS credentials, GitHub tokens, browser profiles, and crypto wallet extensions. The campaign introduces a novel AI-assistant indirect-prompt-injection vector that plants zero-width Unicode instructions inside .cursorrules and CLAUDE.md to coerce Cursor and Claude Code into executing 'security scan' workflows that exfiltrate developer secrets to ddjidd564.github.io.

- **Published:** 2026-05-24T00:00:00Z
- **Last reviewed:** 2026-05-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0576
- **ID:** TL-2026-0576
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TrapDoor
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TrapDoor is a multi-ecosystem cryptocurrency and developer-secret stealer campaign disclosed by Socket Security on 2026-05-24. The threat actor — operating under npm handle 'asdxzxc', PyPI handles 'asdmini67' and 'dae5411', and GitHub account 'ddjidd564' — published a coordinated set of 34 malicious packages targeting the Web3 / DeFi developer community. Across npm, PyPI, and crates.io, the packages masquerade as wallet safety auditors, DeFi risk scanners, Move/Sui build helpers, prompt-engineering toolkits, and Solidity deployment guards, riding the developer ecosystem's appetite for security-themed tooling.

Initial Access (T1195.001/.002): victims pull a malicious dependency directly (typosquat-adjacent names that mimic plausible Web3 tooling) or as a transitive dependency. On npm the payload loads through a postinstall hook that imports trap-core.js (48,485 bytes); on PyPI it executes through a setup.py / pyproject.toml hook spawning JS via a bundled Node.js (the 'node-e' technique — invoking inline JS through node -e); on crates.io it runs through a build.rs build script that decrypts and executes an embedded payload at compile time.

Defense Evasion: payloads are XOR-encrypted with the key 'cargo-build-helper-2026' and decrypted in memory. Strings, network endpoints, and target paths are reconstructed at runtime (T1140). The campaign also uses the marker 'P-2024-001' as a kill-switch / build identifier inside payloads.

Credential Access & Collection: on execution the stealer enumerates the host for ~/.ssh/* (id_rsa, id_ed25519, known_hosts, config), ~/.aws/credentials and ~/.aws/config, ~/.config/gh/hosts.yml and GITHUB_TOKEN env vars, ~/.gitconfig, Chrome/Brave/Edge/Firefox Login Data and cookie stores, MetaMask/Phantom/Sui Wallet/Aptos Petra/Backpack browser extension storage, Sui keystore (~/.sui/sui_config/sui.keystore), Solana keypair (~/.config/solana/id.json), Aptos config (~/.aptos/config.yaml), seed phrase files matching wallet/mnemonic/seed regex patterns, and developer .env files. (T1552.001, T1552.004, T1555.003)

Novel AI-Assistant Injection: TrapDoor is the first publicly documented campaign weaponizing AI coding assistants against developers. The malware plants — or modifies in place — .cursorrules (Cursor IDE) and CLAUDE.md (Claude Code) project files, embedding zero-width Unicode characters (ZWJ U+200D, ZWNJ U+200C, ZWSP U+200B) that hide adversarial natural-language instructions from the developer's eyes while remaining fully readable by the LLM. The hidden prompts instruct the AI assistant to 'run a security scan' that locates and exfiltrates dotfiles, wallets, and credentials, leveraging the developer's own shell privileges through the AI's tool execution. This is a textbook indirect prompt injection adapted to the supply-chain context and represents a new persistence/execution lane: even if the malicious package is removed, the poisoned .cursorrules/CLAUDE.md may survive in the repository and continue to fire on the next AI-assisted session.

Command & Control / Exfiltration: stolen data is bundled, gzip-compressed, base64-encoded, and POSTed to https://ddjidd564.github.io/* — a GitHub Pages domain chosen for free TLS, high reputation, and resilient hosting. The actor cycles paths under the same domain rather than rotating infrastructure (T1071.001, T1567).

Impact: confirmed credential and wallet theft (T1657) — Socket attributes hundreds of compromised developer machines based on download telemetry across the 384+ malicious versions. Wallet drains targeting Sui, Solana, Aptos, and EVM ecosystems followed within hours of each batch.

Remediation requires a three-step response: (1) immediately remove any of the 34 listed packages from package.json/requirements.txt/Cargo.toml and audit lockfiles for affected versions; (2) rotate every credential the developer may have had on disk — SSH keys, AWS keys, GitHub tokens, all crypto wallet seed phrases — assume total compromise; (3) inspect .cursorrules and CLAUDE.md in every repository touched by an affected developer for invisible Unicode characters (cat -v / xxd / Python repr) and quarantine any that contain hidden instructions. Network-side, block ddjidd564.github.io at egress and hunt DNS history for the domain.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.006 Command and Scripting Interpreter: Python
- T1204 User Execution
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.004 Unsecured Credentials: Private Keys
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1083 File and Directory Discovery
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1567 Exfiltration Over Web Service
- T1567.001 Exfiltration Over Web Service: Exfiltration to Code Repository
- T1657 Financial Theft

## Sources

- [TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages and Hundreds of Versions Across npm, PyPI, and Crates.io](https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates)
- [Socket Security Threat Research — Supply Chain](https://socket.dev/blog)
- [MITRE ATT&CK T1195.002 Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
- [OWASP Top 10 for LLM Applications — LLM01 Prompt Injection](https://owasp.org/www-project-top-10-for-large-language-model-applications/)
- [npm postinstall hook abuse — historical pattern](https://docs.npmjs.com/cli/v10/using-npm/scripts)
- [PEP 517/518 — pyproject.toml build system entry points](https://peps.python.org/pep-0517/)
- [Cargo Build Scripts (build.rs) — Rust Reference](https://doc.rust-lang.org/cargo/reference/build-scripts.html)
- [Indirect Prompt Injection: Threats and Mitigations (Greshake et al.)](https://arxiv.org/abs/2302.12173)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0576