"TrapDoor" Poisons `CLAUDE.md` and `.cursorrules` Across npm, PyPI, and Crates.io

34+ malicious packages spanning 384+ versions across npm, PyPI, and Crates.io, impersonating development utilities aimed at crypto, DeFi, Solana, and AI developer communities

The malware harvests SSH keys, AWS credentials, GitHub tokens, browser login databases, environment variables, and crypto wallet keystores for Solana, Sui, and Aptos. Its distinguishing feature is deliberate targeting of AI coding assistants: the payload plants `.cursorrules` and `CLAUDE.md` files, the project-level instruction files that Cursor and Claude Code read automatically, containing instructions concealed with zero-width Unicode characters (U+200B, U+200C, U+200D, and U+FEFF used mid-text). The files look blank or benign in a normal editor, so the developer never reads what the assistant is told. When the assistant acts on them it runs what appears to be a project "security scan" that quietly exfiltrates local secrets. Each ecosystem uses a different trigger: npm postinstall hooks, remote JavaScript executed on Python import, and Rust `build.rs` scripts at compile time. Version-based scanners returned zero findings across all 34 packages because the threat is the code inside them, not a known-vulnerable dependency. Socket detected TrapDoor versions an average of about 5 minutes 56 seconds after publication across 381 versions

AI coding assistants read project configuration files as trusted instructions with no provenance check and no rendering of invisible characters, so a package that can write a file into a developer's workspace can issue commands to that developer's agent. Earliest observed artifact places the campaign start at May 19, 2026