TrapDoor Campaign Deploys 34 Malicious Packages Across npm, PyPI, and Crates.io, Weaponizing AI Coding Assistants to Steal Crypto Wallets

Overview

A coordinated supply chain campaign designated TrapDoor has seeded 34 malicious packages and more than 384 related versions across npm, PyPI, and Crates.io, targeting developers in the crypto, DeFi, and AI communities, according to researchers at Socket who published their findings on May 24, 2026. The campaign’s most novel feature is its weaponization of AI coding assistants: the threat actor embedded hidden instructions into .cursorrules and CLAUDE.md project configuration files, using zero-width Unicode characters to conceal malicious directives that trick tools like Cursor and Claude Code into performing credential exfiltration under the appearance of an automated security scan.

What We Know

Scale and Timeline

The earliest TrapDoor package — eth-security-auditor@0.1.0 on PyPI — was uploaded on May 22, 2026, at 20:20:18 UTC, according to CybersecurityNews and CyberPress. From that anchor point, the campaign expanded rapidly across all three registries: 21 npm packages, 7 PyPI packages, and 6 Crates.io packages, for a total of 34 malicious packages spanning 384 or more version artifacts, as reported by CybersecurityNews. A campaign marker embedded in the attacker’s infrastructure — P-2024-001 — ties all activity together under a single orchestrated operation, per CyberPress.

Package names were designed to blend in with legitimate developer tooling in the crypto and security space. On npm, the malicious packages included wallet-security-checker, chain-key-validator, and eth-wallet-sentinel. On PyPI, names included eth-security-auditor and defi-risk-scanner. On Crates.io, the campaign used sui-move-build-helper and move-analyzer-build, according to GBHackers on Security and CybersecurityNews.

Execution Methods by Registry

Each registry’s package format enabled a different execution pathway for the malware, according to CyberPress and GBHackers on Security:

• npm: Postinstall hooks trigger trap-core.js, a 1,149-line credential harvester. The payload uses Fernet and ECDH encryption to protect exfiltrated data while validating stolen credentials via live API queries. It also establishes persistence through Git hooks, systemd services, and cron jobs.
• PyPI: Packages auto-execute on import, fetching a remote JavaScript payload hosted on the attacker’s GitHub Pages infrastructure. This cross-language delivery — a Python package that downloads and runs JavaScript via node -e — is an unusual evasion technique.
• Crates.io: The Rust ecosystem’s build.rs compilation hook is abused to run malicious code at compile time. Keystores are XOR-encrypted using the hardcoded key cargo-build-helper-2026 before being exfiltrated to GitHub Gists.

Stolen Data

Across all three ecosystems, TrapDoor targets a consistent set of high-value developer credentials and cryptocurrency assets, according to CybersecurityNews: SSH keys, Sui, Solana, and Aptos wallet keystores, AWS credentials, GitHub tokens, browser login databases, crypto wallet extension data, environment variables, and API keys.

Weaponizing AI Coding Assistants

The campaign’s most technically distinctive feature is its systematic targeting of AI coding tools. The threat actor planted hidden instructions in .cursorrules and CLAUDE.md project configuration files — formats that tools like Cursor and Claude Code read automatically to apply project-specific behavior — embedding malicious directives using zero-width Unicode characters that are invisible to human reviewers, as CybersecurityNews and CyberPress both report. The concealed instructions trick the AI assistant into performing hostile credential exfiltration while the developer believes the assistant is executing an automated project security scan.

To propagate these poisoned configuration files, the attacker used the GitHub account ddjidd564 to submit pull requests to prominent open-source AI projects. Targeted repositories included LangChain, LlamaIndex, MetaGPT, Langflow, browser-use, and OpenHands, according to CybersecurityNews. If any of these pull requests had been merged, every developer who cloned the affected repository and used an AI coding assistant would have been exposed to silent exfiltration.

Detection Speed

Socket detected TrapDoor releases with a median time of 5 minutes and 27 seconds, across 381 package-version records with complete timestamps, according to CybersecurityNews and CryptoTimes. The average detection time was 5 minutes and 56 seconds, with a fastest detection of 58 seconds after publication, per CyberPress.

What We Don’t Know

The identity or affiliation of the threat actor behind the GitHub account ddjidd564 has not been established publicly. It is unclear how many developers installed the malicious packages before they were removed, or whether any of the pull requests targeting LangChain, LlamaIndex, MetaGPT, Langflow, browser-use, or OpenHands were merged. The campaign marker P-2024-001 suggests either a long-running operation dating to 2024 or a deliberate misdating intended to confuse attribution.

Context

TrapDoor is the third significant supply chain incident to hit the major open source registries within two weeks. On May 24, a Packagist tag-hijack campaign compromised over 700 Laravel-Lang package versions with a cross-platform credential stealer. Earlier this month, the Mini Shai-Hulud worm compromised more than 170 npm and PyPI packages with 518 million combined downloads.

The AI assistant targeting technique is new. Previous registry attacks — including the Bitwarden CLI backdoor in April — targeted developer credentials directly via postinstall hooks and did not attempt to route exfiltration through AI tools. TrapDoor’s use of .cursorrules and CLAUDE.md as attack vectors represents a logical escalation as AI coding assistants become ubiquitous in development workflows: if the assistant is trusted to run commands and access files autonomously, compromising its configuration is equivalent to compromising the developer’s own shell.

GitHub’s npm registry shipped staged publishing and install-source allowlists on May 22 — the same day TrapDoor’s first package appeared — as previously reported. Those controls require npm CLI 11.15.0 or newer, and TrapDoor’s malicious packages would have been gated behind a human-approved, 2FA-verified publishing queue had all consumers already enforced the new allowlist policy — a timing that underscores how rapidly the registry security landscape is evolving in response to exactly this class of threat.