TrapDoor — Cross-Ecosystem Supply-Chain Credential Stealer

TrapDoor is a coordinated cross-ecosystem software supply-chain campaign that simultaneously weaponizes npm, PyPI, and Crates.io — at least 34 malicious packages across 384+ versions — to deliver credential-stealing malware to developers in the crypto, DeFi, Solana, and AI tooling communities. Earliest publication was recorded 2026-05-22 20:20 UTC, pushed in rapid waves from a small cluster of throwaway registry accounts.

The campaign is notable for three things: (1) per-runtime execution paths — npm postinstall hooks run a shared trap-core.js payload, PyPI packages auto-execute on import and fetch attacker JavaScript that runs via node -e, and Rust crates execute through build.rs at compile time; (2) secret theft and lateral movement — it scans for crypto wallets/keystores, validates AWS and GitHub tokens, harvests SSH keys and browser data, and attempts SSH-based pivoting; and (3) AI coding-assistant poisoning — it plants hidden instructions inside .cursorrules and CLAUDE.md project files using zero-width Unicode characters, tricking AI agents into re-running credential-discovery "security scans." Exfiltration rides legitimate GitHub infrastructure (GitHub Pages payload host, GitHub Gists for Rust exfil), and persistence is planted via cron, systemd, Git hooks, shell hooks, and SSH config.

Defender priority: The highest-value, lowest-FP detection is a package-manager process (npm/pnpm/yarn, pip/python, cargo) spawning node -e or reaching out to *.github.io / gist.github.com during install/build. Pair that with file-write monitoring on .cursorrules, CLAUDE.md, and ~/.ssh/ on developer and build endpoints. Treat any hit as a credential-compromise event: rotate the dev's wallet keys, SSH keys, and cloud/GitHub tokens immediately.

Web-hunter note: Atomic file hashes for trap-core.js were not published at time of writing (only the byte count / line count). The IOC appendix therefore leads with the named registry packages, accounts, and infrastructure (all source-attributed) and uses REPLACE_WITH_SHA256 placeholders for binary hashes — confirm against your registry mirror / artifact store before promoting to prevent.

Hunt hypotheses (ordered by fidelity)

1. H1 (high): A package manager (npm/pnpm/yarn) triggers a postinstall script that launches node running trap-core.js, scanning for credentials. → Q1
2. H2 (high): A Python process imports a malicious package and spawns node -e with inline JavaScript fetched from an external host. → Q2
3. H3 (high): A dev/build process (node/python/cargo) makes outbound connections to *.github.io or gist.github.com during install/build — payload pull or Gist exfil. → Q4
4. H4 (medium): cargo build spawns a build.rs-driven child that reads keystores and reaches network during compile. → Q3
5. H5 (medium): A new or modified .cursorrules / CLAUDE.md file appears on a developer endpoint shortly after a package install. → Q5
6. H6 (medium): A package-manager-descended process writes to ~/.ssh/authorized_keys, installs a systemd unit, or registers a cron job (persistence). → Q6
7. H7 (medium): node executes with an -e one-liner containing eval/fetch/child_process tokens (generic loader behavior). → Q7

Attack chain

All values below are source-attributed (Socket / The Hacker News). Defang restored on copy. Registry package names are the primary atomic IOCs; binary hashes were not published and are placeholdered in the appendix.

• GitHub org audit: Review PRs opened by ddjidd564 (or any new external contributor) against AI/agent repos (browser-use/browser-use, langchain-ai/langchain, langflow-ai/langflow were targeted). Flag dependency-adding PRs from low-reputation accounts.
• Registry / artifact proxy logs: Search Artifactory/Nexus/registry-proxy access logs for the 34 named packages (full list in s10). Any download = potential exposure.
• SCA / Dependabot: Run an org-wide dependency scan for the named packages and any version published after 2026-05-22.
• Cloud token usage: In CloudTrail/GitHub, hunt for AWS STS calls or GitHub token use from developer hosts immediately following a package install window.
• Repo grep: Search developer repos for .cursorrules / CLAUDE.md containing zero-width Unicode (U+200B/U+200C/U+200D/U+FEFF) or unexpected "run a security scan" directives.

Q1, Q3, Q6, Q7 stay Investigate-only hunts until baselined — postinstall, build.rs, and node -e have legitimate developer uses.

• Telemetry ready: Confirm Falcon Linux/macOS sensors are deployed on developer laptops and CI runners (Windows-only coverage misses most of this campaign).
• Benign baseline: Run Q1/Q3/Q7 for 7 days in your environment, catalog legitimate postinstall/build.rs/node -e usage, build exclusion lists before promoting any to Detect.
• Positive tests: In a sandbox, simulate python -c "import os; os.system('node -e \"console.log(1)\"')" to confirm Q2 fires; create a .cursorrules via a script to confirm Q5.
• Promotion: Promote Q2 and Q4 (named host) to Custom IOA first; hold Q1/Q3/Q6/Q7 as scheduled hunts until baselined.

1 · Org-wide npm install-script lockdown (.npmrc)

# /etc/npmrc or repo .npmrc — neutralize postinstall execution
ignore-scripts=true
# enforce integrity + frozen lockfile in CI
audit=true
fund=false

2 · CI guard — fail on the named TrapDoor packages (bash)

#!/usr/bin/env bash
set -euo pipefail
BAD="crypto-credential-scanner|eth-wallet-sentinel|web3-secrets-detector|wallet-security-checker|solidity-deploy-guard|cryptowallet-safety|eth-security-auditor|defi-risk-scanner|solidity-build-guard|move-analyzer-build|sui-move-build-helper"
if grep -E -q "\"($BAD)\"" package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null; then
  echo "TrapDoor package detected in lockfile - failing build"; exit 1
fi
echo "lockfile clean of known TrapDoor packages"

3 · Sweep for AI-config poisoning (zero-width Unicode)

# flag .cursorrules / CLAUDE.md containing zero-width chars
grep -rlP "[\x{200B}\x{200C}\x{200D}\x{FEFF}]" \
  --include=".cursorrules" --include="CLAUDE.md" /home /Users 2>/dev/null

4 · Block payload host at the proxy (Squid example)

# /etc/squid/trapdoor.acl
acl trapdoor_c2 dstdomain ddjidd564.github.io
http_access deny trapdoor_c2

Validation: Coverage is strongest on the execution and C2 steps (Q2/Q4 promotable to IOA). The main gap is silent in-memory secret validation, which leaves no local artifact — close it with egress control (s12) and cloud-side token-use monitoring (s7) rather than endpoint detection.