TrapDoor Hid Malicious Orders Inside CLAUDE.md and .cursorrules. The Attacker's Real Target Was Your AI Coding Assistant.

The first package landed on PyPI at 20:20:18 UTC on Friday night. It was called eth-security-auditor, version 0.1.0, and it looked like exactly what its name suggested: a security scanner for Ethereum contracts. A developer auditing a DeFi project, scrolling for the right tool, would have no reason to pause.

Socket's automated scanners flagged it 58 seconds later.

What they found, when they pulled the package apart, was the opening move of one of the most carefully engineered supply chain campaigns of 2026. Over the following 72 hours, Socket traced the same threat actor across three ecosystems. The campaign, which Socket dubbed TrapDoor, ultimately spanned 34 malicious packages and more than 384 versions across npm, PyPI, and Crates.io. The malware harvested SSH keys, AWS credentials, GitHub tokens, browser login databases, and crypto wallet keystores for Solana, Sui, and Aptos chains.

But the part that has security researchers genuinely worried is not the credential theft. It is the malware's second target: the AI coding assistant sitting in the developer's editor.

The Attack That Tried to Recruit Claude and Cursor

When a malicious package lands in a developer's node_modules, it has a brief window to act before something blocks it. Most credential stealers race to grab what they can on first install. TrapDoor does that. Then it does something unusual. It edits two files that have become standard furniture in every AI-augmented repository.

The first is .cursorrules, the project-level instruction file Cursor reads before responding to anything. The second is CLAUDE.md, the project memory file Claude Code reads to understand what a codebase is for.

Both files exist for the same reason. They tell the AI: "This is the context. Follow these rules." They are read on every interaction. They are trusted by the assistant the way a junior engineer trusts a written runbook.

Into both files, TrapDoor injects hidden instructions written in zero-width Unicode characters, codepoints like U+200B and U+200C that occupy no visible space on the page but still flow into a language model's tokenizer the same as any other letter. A developer reviewing CLAUDE.md sees nothing changed. The AI reads instructions that were never visibly there.

According to Socket's analysis published Monday, the hidden instructions ask the assistant to run a "security scan" that quietly performs secret discovery and exfiltration. As Socket explained the attack pipeline:

How One PyPI Upload Became a 34-Package Campaign

The TrapDoor packages were not uploaded all at once. Socket's telemetry shows them arriving in coordinated waves from a cluster of accounts, each wave a different ecosystem. PyPI first. npm second. Crates.io third. Then a second pass with new names and new accounts to replace what got removed.

The execution paths reflect careful homework on each registry's quirks.

The shared trap-core.js payload is the heart of the campaign. It scans the developer's machine for SSH keys, AWS access tokens, GitHub credentials, browser session cookies, and crypto wallet files. It validates the stolen AWS and GitHub tokens by making live API calls against each cloud provider, throwing away anything already revoked. Then it digs in: persistence is installed through systemd units, cron jobs, Git hooks, shell hooks, and SSH authorized_keys modifications.

The Python packages take a different route. They are designed to auto-execute at import time and to fetch their real payload from a remote GitHub Pages domain controlled by the attacker, ddjidd564.github[.]io, before running it with node -e. Socket explained the reasoning:

The package names were chosen to look exactly like what a target audience would search for. The crypto and DeFi developers got eth-security-auditor, defi-risk-scanner, wallet-backup-verifier, mnemonic-safety-check. The Sui and Move developers got move-analyzer-build, sui-framework-helpers, sui-move-build-helper. The AI developers, the newest target population, got llm-context-compressor, model-switch-router, and prompt-engineering-toolkit.

The Detection Race Socket Won, Just Barely

Across 381 package-version records with complete timestamps, Socket logged a median detection time of 5 minutes and 27 seconds between an upload and a malicious classification. The fastest was 58 seconds. The average sat at 5 minutes and 56 seconds.

That window is the entire game in modern supply chain defense. A package needs to live long enough for npm install or pip install somewhere in the world to pull it in. Socket's argument, baked into its detection pipeline, is that under six minutes is short enough to keep adoption near zero. For most of the TrapDoor packages, that appears to have worked. Reported download counts for the malicious versions sit in the low thousands at most.

But "most" is the operative word. The mini Shai-Hulud npm worm earlier this month closed in about 20 minutes and still poisoned 317 packages, and PyTorch Lightning's 42-minute window in late April still required credential rotation at affected teams. A six-minute median is better. It is not zero.

The Open-Source Pull Requests That Targeted LangChain

What sets TrapDoor apart is what the attacker did beyond the registries. According to The Hacker News reporting on Socket's findings, the same threat actor opened pull requests to popular AI and developer projects, including browser-use/browser-use, langchain-ai/langchain, and langflow-ai/langflow. Each PR proposed adding what looked like normal project documentation. Each PR contained zero-width Unicode characters embedded inside the proposed file.

Socket's read of the activity is direct. The threat actor is testing whether AI-related project files can be introduced through the regular open-source contribution workflow, so that any developer or AI tool that later reads those files will quietly act on the hidden instructions.

That is a fundamental shift in the threat model. For two years, supply chain attacks have been about getting code onto a developer's machine. With TrapDoor, the attacker is also trying to get hidden text into the AI's context, where it never has to be run as code at all. The assistant runs it.

How TrapDoor Compares to the Worst of 2026 So Far

TrapDoor is not the largest by package count. The npm worm that ripped through 317 packages on May 19 still holds that title for the year. But TrapDoor is the first widely-reported supply chain campaign that deliberately weaponizes the AI coding assistant rather than treating it as a bystander. The mini Shai-Hulud worm tried to spread sideways through other maintainers. TrapDoor tries to spread sideways through Claude.

The Counterargument: This Is Old Trickery in New Clothes

Not every researcher sees TrapDoor as a category shift. Zero-width Unicode obfuscation is a technique that predates large language models by decades. It was first used to smuggle commands into terminal emulators in the 1990s and has been a recurring topic in homoglyph and bidi-spoofing research ever since. The novelty here is the target, not the trick.

The base credential-theft mechanism also works without any AI involvement. A developer running npm install on a TrapDoor-laced project loses their AWS keys and SSH keys regardless of whether they use Cursor, Notepad, or vi. The AI-targeting layer increases blast radius for the specific case where the assistant later interacts with a repository the attacker is in. It does not create the initial breach.

Defenders also have a real point about response speed. Socket flagged the first package in under a minute, GitHub and PyPI surfaced takedowns within hours, and the per-version download counts stayed small. The six-minute median is short enough that, for most developers, the campaign was effectively invisible. None of that erases the AI angle. It does put it in proportion.

The Immediate Steps for Engineering Teams

For any team using AI coding assistants on projects that pull from npm, PyPI, or Crates.io, the response from Socket and the wider security community converges on the same checklist.

• Audit .cursorrules and CLAUDE.md for zero-width Unicode. The Python snippet print(repr(open('CLAUDE.md').read())) will surface invisible characters. Anything outside expected ASCII and printable Unicode in those files should be removed.
• Rotate AWS, GitHub, npm, and crypto wallet credentials on any machine where the listed TrapDoor packages were installed since May 22. Socket maintains a live indicator-of-compromise list on its supply-chain-attacks page, including the full set of malicious package names across the three ecosystems.
• Check ~/.ssh/authorized_keys, crontab -l, and systemctl list-unit-files for persistence entries planted by trap-core.js.
• Restrict postinstall execution in CI using npm ci --ignore-scripts for sensitive runs, and pair it with similar guards for pip install and cargo build.
• Treat .cursorrules and CLAUDE.md as security-relevant configuration, not documentation. Any change should pass the same review that a permission change to a CI workflow file would.

For broader context on the supply chain attacks LDS has covered this spring, see the npm worm that poisoned 317 packages on May 19, the PyTorch Lightning compromise that closed in 42 minutes, and the LiteLLM backdoor that handed attackers 95 million monthly downloads.

The Bottom Line

TrapDoor is the moment the AI coding assistant became part of the attack surface. For years, supply chain attacks have been about getting code onto a developer's machine. TrapDoor is about getting instructions into an AI's context that the developer cannot see and the AI cannot distinguish from legitimate guidance. The pull requests to LangChain and browser-use make the intent explicit: this is not a one-off. The attacker is probing how far hidden text can travel through the open-source workflow.

The technical countermeasures are not exotic. Pin dependencies. Audit instruction files. Rotate credentials on suspicion. What is new is the question of who reads what. A CLAUDE.md file is now a security boundary. The next time a security audit covers a repository, that file belongs on the same list as .github/workflows/release.yml and Dockerfile.

As Socket described the broader pattern on Monday: "TrapDoor shows how attackers are combining traditional package typosquatting with newer developer-environment attack paths."

What an AI reads is now a credential.

Sources

• TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages (Socket Threat Research, May 25, 2026)
• TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO (The Hacker News, May 25, 2026)
• TrapDoor Supply Chain Campaign: Cross-Ecosystem Credential Theft and AI Assistant Poisoning (Phoenix Security, May 25, 2026)
• Hackers Compromised 34 Packages in npm, PyPI, and Crates in New Supply Chain Attack (Cybersecurity News, May 25, 2026)
• TrapDoor: Malicious npm, PyPI, Crates.io Packages Target Developer Secrets & AI Tooling (SOCRadar, May 25, 2026)
• TrapDoor Supply Chain Attack Actively Exploiting npm, PyPI, and CratesIO (Rescana, May 25, 2026)
• TrapDoor Malware Hits npm, PyPI & Crates.io, Steals Crypto Wallets & SSH Keys (Crypto Times, May 25, 2026)