TrapDoor: 34 fake crypto, AI and dev-tool packages on npm, PyPI and crates.io stole wallets and secrets and planted CLAUDE.md and .cursorrules

What happened

Socket found a campaign it calls TrapDoor: more than 34 malicious packages across npm, PyPI and crates.io, with more than 384 versions. The first upload was PyPI eth-security-auditor@0.1.0 at 20:20:18 UTC on 22 May 2026, followed by waves over the weekend of 23 and 24 May (Socket). The names pose as crypto, DeFi, Solana, AI tooling, environment setup and security utilities (The Hacker News). These were never real projects, so this is not a hijack of anything you depended on deliberately.

npm (21), published by the user asdxzxc: async-pipeline-builder, build-scripts-utils, chain-key-validator, crypto-credential-scanner, defi-env-auditor, defi-threat-scanner, deployment-key-auditor, dev-env-bootstrapper, eth-wallet-sentinel, llm-context-compressor, mnemonic-safety-check, model-switch-router, node-setup-helpers, project-init-tools, prompt-engineering-toolkit, solidity-deploy-guard, token-usage-tracker, wallet-backup-verifier, wallet-security-checker, web3-secrets-detector, workspace-config-loader

PyPI (7), from accounts tied to asdmini67 and dae5411: cryptowallet-safety, data-pipeline-check, defi-risk-scanner, env-loader-cli, eth-security-auditor, git-config-sync, solidity-build-guard

crates.io (6): move-analyzer-build, move-compiler-tools, move-project-builder, sui-framework-helpers, sui-move-build-helper, sui-sdk-build-utils

Socket does not list versions beyond eth-security-auditor@0.1.0. Treat every version of these names as malicious. As of 2 November 2026, all 21 npm names show only an npm security placeholder, and all 13 PyPI and crates.io names return “not found”. The GitHub account ddjidd564 that hosted the payloads is also gone.

How the payload works

Details from Socket:

• npm: a postinstall hook runs a shared trap-core.js (1,149 lines, 48,485 bytes). It scans for credentials, checks AWS and GitHub tokens against their APIs, and tries to spread over SSH. It encrypts with Fernet and ECDH.
• PyPI: on import, the package downloads JavaScript from ddjidd564[.]github[.]io and runs it with node -e, so the attacker can change behaviour without a new release.
• crates.io: a malicious build.rs runs during cargo build. It searches for local keystores, XOR-encrypts them with the key cargo-build-helper-2026, and uploads them to GitHub Gists.
• Targets: SSH keys; Sui, Solana and Aptos wallets; AWS and GitHub credentials; browser profiles and login databases; wallet extension data; environment variables; API keys; local development config files.
• Persistence: .cursorrules, CLAUDE.md, git hooks, shell hooks, systemd services, cron jobs, and SSH. Socket does not give exact file paths, unit names or cron lines.

AI agent files. The planted .cursorrules and CLAUDE.md contain zero-width Unicode instructions that try to make an AI coding assistant run a “security scan” that finds and exfiltrates secrets. The .cursorrules JSON carries the marker "standard": "P-2024-001" and a config URL on the attacker’s GitHub Pages site. ddjidd564 also opened pull requests adding these files to browser-use/browser-use, langchain-ai/langchain, langflow-ai/langflow, run-llama/llama_index, FoundationAgents/MetaGPT and OpenHands/OpenHands, titled “docs: add .cursorrules with dev standards and build verification” or “docs: add CLAUDE.md with dev standards and build verification” (Socket). Socket does not say whether any were merged.

Am I affected?

# npm: lockfiles and installed tree
grep -nE '(async-pipeline-builder|build-scripts-utils|chain-key-validator|crypto-credential-scanner|defi-env-auditor|defi-threat-scanner|deployment-key-auditor|dev-env-bootstrapper|eth-wallet-sentinel|llm-context-compressor|mnemonic-safety-check|model-switch-router|node-setup-helpers|project-init-tools|prompt-engineering-toolkit|solidity-deploy-guard|token-usage-tracker|wallet-backup-verifier|wallet-security-checker|web3-secrets-detector|workspace-config-loader)' \
  package-lock.json yarn.lock pnpm-lock.yaml bun.lock 2>/dev/null
find ~ -name trap-core.js -not -path '*/.Trash/*' 2>/dev/null

# PyPI
pip show cryptowallet-safety data-pipeline-check defi-risk-scanner env-loader-cli \
  eth-security-auditor git-config-sync solidity-build-guard 2>/dev/null | grep -E '^(Name|Version)'

# crates.io: Cargo.lock and the local registry cache
grep -nE 'name = "(move-analyzer-build|move-compiler-tools|move-project-builder|sui-framework-helpers|sui-move-build-helper|sui-sdk-build-utils)"' Cargo.lock 2>/dev/null
ls ~/.cargo/registry/src/*/ 2>/dev/null | grep -E '^(move-analyzer-build|move-compiler-tools|move-project-builder|sui-framework-helpers|sui-move-build-helper|sui-sdk-build-utils)-'

Then look for the persistence Socket describes. These checks need judgement, because the exact names were not published:

# Planted agent files with the campaign marker or attacker host
grep -rlE 'P-2024-001|ddjidd564' --include=.cursorrules --include=CLAUDE.md ~ 2>/dev/null

# Zero-width characters hidden in agent files
find ~ \( -name .cursorrules -o -name CLAUDE.md \) -type f -exec perl -CSD -ne \
  'if (/[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{2064}\x{FEFF}]/) { print "$ARGV\n"; close ARGV }' {} + 2>/dev/null

# Git hooks that are not the .sample defaults
find ~ -path '*/.git/hooks/*' -type f ! -name '*.sample' 2>/dev/null

# Cron, user systemd units, shell start-up files and SSH keys changed since 22 May 2026
crontab -l 2>/dev/null
ls -la ~/.config/systemd/user/ 2>/dev/null
find ~/.bashrc ~/.zshrc ~/.profile ~/.bash_profile ~/.ssh -newermt 2026-05-22 2>/dev/null

In DNS and proxy logs, look for ddjidd564.github.io and unexpected Gist uploads from build machines from 22 May 2026 onward.

What to do now

1. Remove the package and rebuild. Delete it from manifests and lockfiles, delete node_modules, the virtual environment or target/ and ~/.cargo/registry copies, and reinstall. A build.rs payload ran during the build, so a crate that only reached cargo build still counts.
2. Rotate. SSH keys, AWS and GitHub credentials, other API keys, and secrets in environment variables and local config files, the categories Socket lists. Clear saved browser logins on the affected machine.
3. Move crypto funds from any Sui, Solana, Aptos or browser-extension wallet that was on the machine to a wallet created on a clean device.
4. Remove persistence you did not create: the agent files, git hooks, cron entries, systemd units, shell start-up lines and SSH authorized_keys entries found above. Check other hosts this machine could SSH to, since trap-core.js tried to spread that way.
5. If you maintain an AI or agent project, review merged pull requests that add .cursorrules or CLAUDE.md, and check them for hidden Unicode. GitHub shows a warning banner on files with hidden or bidirectional characters.

Why this matters

TrapDoor is aimed at AI coding assistants as well as people. A rules file with hidden instructions persists in the repository and runs whenever an agent reads it, long after the package is gone. Treat CLAUDE.md, .cursorrules and similar files as code in review.

Sources

• Socket: TrapDoor crypto stealer across npm, PyPI and crates.io
• The Hacker News: TrapDoor supply chain attack spreads across npm, PyPI and crates.io
• Socket campaign tracker: TrapDoor