Socket disclosed TrapDoor, a cross-ecosystem campaign that published 34 or more malicious packages across 384 or more versions on npm, PyPI and Crates.io to steal developer secrets and cryptocurrency wallet keys. Its distinctive element is a second, AI-specific delivery path: poisoning the configuration files an AI coding assistant reads, .cursorrules and CLAUDE.md, either inside a malicious package or through an innocuous documentation pull request such as 'docs: add .cursorrules with dev standards'. The instructions are concealed in zero-width Unicode characters and are therefore invisible in a normal diff view. When a developer later clones the repository and opens an AI coding assistant, the assistant reads the file as guidance and is directed to run a disguised 'security scan' or 'wallet safety check' that discovers local secrets and exfiltrates them to attacker-controlled GitHub Pages or Gists; no malicious package need be installed. Targets included SSH keys, AWS credentials, GitHub tokens, browser login databases, environment variables, API keys and Solana, Sui and Aptos wallet keystores, with stolen AWS and GitHub credentials validated by live API calls. The campaign was seeded May 19-22 2026, with pull requests from the GitHub account ddjidd564 against browser-use, langchain, langflow, llama_index, MetaGPT and OpenHands.
ASSESSED SYSTEM
An AI coding assistant deployment on a developer workstation in its default trusting configuration, as exposed to the TrapDoor campaign between the May 19-22 2026 seeding and Socket's June 1 2026 disclosure: an assistant that reads repository instruction files (.cursorrules, CLAUDE.md, AGENTS.md) as authoritative guidance, and that can read local files, execute shell commands and make outbound network calls within a session. Representative deployment, because the affected population is every workstation that cloned an affected repository rather than one named victim.
OUT OF SCOPE
The non-AI half of the campaign is out of scope as conventional software supply-chain compromise with no AI component in the execution path: npm postinstall execution of trap-core.js, PyPI import-time execution, and the Crates.io build.rs path. Those are noted as the parallel delivery vector because they also plant the poisoned instruction files. Also out of scope: host-level persistence (Git hooks, shell hooks, systemd, cron, SSH authorized_keys), lateral movement using stolen SSH keys, the registries themselves, and any specific assistant vendor's product state after disclosure.
Architecture: Agentic / MCP System (decision tree Q2) — Q2 = YES. The assistant autonomously plans and executes a multi-step workflow from a single piece of ingested guidance: it reads the instruction file, runs a disguised 'security scan' or 'wallet safety check', enumerates local secret paths, and makes outbound calls — without explicit human approval for each action. Evidence in the brief: the assistant 'reads the file as guidance and is told to run a security scan', the workflow 'discovers local secrets and exfiltrates them', and the recommended fix is to 'require explicit approval before reading secret paths, running shell commands, or making network calls', which indicates such approval was not required in the assessed configuration. Q1 = NO: a single assistant, no agent-to-agent exchange. Tier 3: Tier 3 Internal: spec 4 lists code assistants as the canonical Tier 3 example — the deployment sits inside an organisational boundary with controlled users (developers), not in direct public interaction. The counter-argument, that stolen AWS keys, GitHub tokens and wallet keystores are immediate financial harm, is acknowledged; under AITBM that blast radius is carried by Cascade Potential (Cp = 1.00) and the Containment sub-metrics, not by the tier, which classifies the deployment's role rather than the incident's reach.
Documented attack or failure path
- The attacker lands a poisoned .cursorrules or CLAUDE.md in a popular repository, either bundled in a malicious package or via a documentation-style pull request; the real instructions are carried in zero-width Unicode and do not appear in a normal diff.
- A developer clones the repository and opens an AI coding assistant in that workspace; the assistant ingests the instruction file as authoritative guidance with no provenance check, signature check or hidden-character normalisation.
- The concealed instructions direct the assistant into a disguised workflow — a 'security scan', 'wallet safety check' or 'cloud configuration validation' — whose benign label maps onto credential discovery.
- The assistant reads secret material reachable from the developer's home directory: SSH keys, AWS credentials, GitHub tokens, browser login databases, environment variables, API keys and Solana, Sui and Aptos wallet keystores.
- The material is exfiltrated to attacker-controlled GitHub Pages and Gists; the payload then validates stolen AWS and GitHub credentials with live API calls to separate working secrets from expired ones.
- Persistence is re-established through the same instruction files (.cursorrules, CLAUDE.md) alongside host-level mechanisms, so the poisoned guidance survives cleanup that only removes packages.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The campaign required a deliberate 'disguise layer' mapping credential theft onto benign-sounding tasks — security audits, wallet safety checks, cloud configuration validation. That investment is positive evidence that plainly-worded malicious instructions are refused by the assistants' existing safety behaviour; Ro-1 is scored at 0.25 rather than 0.00 on this basis.
- The attacker had to conceal instructions in zero-width Unicode to survive human pull-request review, which indicates that visible malicious instruction text in a diff would have been caught. Human code review was a real barrier the attacker routed around rather than one that was absent.
- The campaign's own operational security was poor and made reliable detection and cleanup possible: a single GitHub account and domain (ddjidd564, ddjidd564.github.io), a fixed campaign marker P-2024-001, a fixed payload size for trap-core.js (48,485 bytes) and a hardcoded Rust XOR key (cargo-build-helper-2026). This supports responder detection but is not a control of the assessed deployment.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.07–0.53 (midpoint 0.30), Tier 3 MVT 0.40 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.30 | 0.25 anchor: basic filters resist naive attacks but fail under a moderate obfuscation budget — here zero-width Unicode plus semantic disguise. Not 0.00, because the attacker's investment in concealment is evidence that unconcealed injections are refused; not 0.50, because the assistant was steered into a full unsafe tool-mediated workflow rather than merely producing unsafe text. | Instructions concealed in zero-width Unicode inside .cursorrules and CLAUDE.md steered the assistant into a disguised credential-discovery workflow. The attacker built a 'disguise layer' mapping credential theft onto benign-sounding tasks, and used invisible characters rather than plain text — both indicate that direct, visible malicious instructions are resisted by existing filters while the obfuscated, disguised variant succeeds. No hidden-character normalisation is applied on the instruction-file ingestion path; AID-D-001.001 has to be recommended to 'inspect raw, normalized, rendered, and decoded views'.source: researcher |
| Ro-4Poisoning Attack Resistance | 0.00w 0.25 | 0.00 anchor: no data, memory, tool or feedback integrity validation exists on this ingestion path — poisoned sources are accepted without scanning, provenance checks or quarantine, which is the literal criterion. Ro-4's definition explicitly covers memory, tool-description and feedback-channel manipulation, and an agent instruction file is exactly such a channel. | The assistant's own guidance corpus was the poisoned asset. Repository instruction files are ingested as authoritative guidance with no source validation, no provenance check, no signature and no scanning, and the payload re-establishes persistence through those same files (trap-core.js 'establishes persistence through .cursorrules, CLAUDE.md'). AID-H-021.001 is the recommended control precisely because nothing validates 'their source, structure, policy alignment, remote URLs, hidden characters, and high-risk instructions' before the assistant reads them.source: researcher |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Transparency (Tr) — scenario interval 0.05–0.85 (midpoint 0.45), Tier 3 MVT 0.45 indeterminate | |||
| Tr-4Model Lineage Disclosure | 0.25w 0.20 | 0.25 anchor: limited lineage artefacts exist for the base model only; configuration lineage — here the assistant's own instruction-file history, owners and review dates — is incomplete, and the recorded artefact does not faithfully disclose the configuration's content. | The brief's additional consideration states the finding directly: AI-assistant instruction files 'are rarely reviewed with the same scrutiny as code, and zero-width Unicode hides their real contents from a normal diff'. The recommendation is to require review of instruction-file changes and to render hidden and zero-width characters visible. Git history nominally records who added the file (the ddjidd564 pull requests), so a lineage record exists, but the assistant's material configuration lineage is not part of any assurance artefact and its true content is not visible in the record.source: brief |
| Privacy (Pr) — scenario interval 0.09–0.74 (midpoint 0.41), Tier 3 MVT 0.50 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.25w 0.35 | 0.25 anchor: some minimisation controls exist (workspace-scoping conventions in the assistant, and the boundary is configurable), but the assessed configuration left unnecessary sensitive fields and secret paths reachable from the agent's execution context. | The assistant process had ambient reach to material a coding task does not need: SSH keys, AWS credentials, GitHub tokens, browser login databases, environment variables, API keys and wallet keystores. AID-H-022.001 recommends ephemeral sandboxes with 'no developer home directory mounted, no SSH material, and no long-lived secrets', and the defender guidance asks teams to 'require explicit approval before reading secret paths' — both indicate no minimisation boundary existed between the assistant and the developer's secret material.source: brief |
| Containment (Cn) — scenario interval 0.07–0.67 (midpoint 0.37), Tier 3 MVT 0.50 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.12 | 0.25 anchor: basic boundaries exist but are enforced inconsistently — a workspace scope is present, yet simple instruction manipulation moved the assistant outside it, into the home directory and out to the internet. | In the assessed configuration the assistant read secret paths outside the project directory and made outbound network calls to attacker-controlled GitHub Pages and Gists. The defender guidance — 'Configure AI coding assistants to treat repository files as data, not instructions, and to require explicit approval before reading secret paths, running shell commands, or making network calls' — indicates that boundary machinery exists and is configurable, but did not block filesystem or network scope violations by default.source: brief |
| Cn-2Escalation Prevention | 0.25w 0.16 | 0.25 anchor: basic role checks exist but are vulnerable to prompt injection, role confusion and tool misuse; tool-permission amplification, named in the Cn-2 definition, is what occurred. | A file read as documentation amplified the assistant's effective authority from code editing to secret reading, shell execution and network egress. AID-M-009.002 has to be recommended to 'Classify secret access, shell execution, and network egress as outside the routine envelope', which indicates no authority envelope constrained the amplification. The disguise layer means the assistant believed it was performing a routine audit, a role-confusion failure rather than an OS-level privilege break.source: brief |
| Cn-6Action Reversibility Classification Rate | 0.00w 0.12 | 0.00 anchor: no reversibility classification is performed before execution and automated actions execute ungated (ARCR = 0). No worst-case chain composition rule applies either — the irreversible egress hop did not govern the classification of the 'security scan' workflow that contained it. | Exfiltrating credentials to an attacker-controlled endpoint is a delegated-irreversible action — the disclosure cannot be undone and its impact is external — and it executed with no pre-execution reversibility classification and no gate. AID-M-009.002 is recommended to classify secret access, shell execution and network egress as high-risk actions, which indicates that no such classification governed execution in the assessed configuration.source: brief |
Unknown, not N/A: 16 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.85w 0.20 | Between the 0.75 and 1.00 anchors. The assistant executed a multi-step workflow — file reads across the home directory, shell execution and outbound network calls — inside a single session without per-action approval, which exceeds supervised autonomy for high-consequence actions. Scored below 1.00 because a developer is nominally present at the keyboard and can observe and interrupt the session, so oversight is asynchronous rather than absent. elevated |
| AsAttack Surface Exposure | 0.85w 0.25 | Between the 0.75 and 1.00 anchors. The assistant ingests wholly untrusted third-party content — arbitrary cloned repositories, externally-contributed pull requests, and packages from npm, PyPI and Crates.io — which is stronger than the 0.75 anchor's 'partially trusted' sources, and it runs with tool and connector integration. Scored below 1.00 because the deployment is not internet-facing in the inbound sense: no external user drives it directly, and no multi-agent channel is evidenced. elevated |
| CpCascade Potential | 1.00w 0.30 | No verified System Dependency Graph exists, so the spec 3.2 worst-case default applies, and the 1.00 anchor is independently corroborated on the observed path. Untrusted repository content (entry) reached the assistant's orchestration layer, then its file, shell and network tools, then external systems, with no gate anywhere on the path — LRR = 1.00. The terminal node is P4, credential- and permission-issuing: the exfiltrated AWS keys and GitHub tokens confer further access, and the payload validated them with live API calls to confirm exactly that. Stolen SSH keys were then reused for lateral movement, extending the amplification depth further.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.30w 0.25 | Slightly above the 0.25 model-adjacent anchor. The enumerated remediations are infrastructure and configuration work implementable in days: client-side configuration enforcement, hidden-Unicode and obfuscation scanning, inference-time input validation, pre-merge dependency review, sandboxed installs and builds, and default-deny egress. None requires retraining. Scored above 0.25 because the underlying behaviour — an assistant treating repository files as authoritative instructions — is a vendor-side product trust-boundary change rather than a customer patch, and the fix must land on every developer workstation and CI environment rather than one server. |
Nelevated = 3 (dimensions strictly above 0.75) → CRM = 1.35.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Socket documents the campaign artefacts thoroughly (package names and version counts, payload name and byte size, campaign marker, XOR key, attacker account, targeted repositories), but that is provenance of the attack, not of the assessed deployment. For the assessed AI system the record is minimal: the assistant class and the instruction files it reads are documented; the model, model version, tool manifest, permission matrix and identity policy of any specific deployment are not, and no AIBOM exists. |
| Ec — Public evaluation coverage | 0.29 | coverage 0.30 (7 of 23 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.35 | Evidence dated 2026-05-24; age 81 days on the workpaper reference date. Components: C_event 0.35 · T_behavior 0.40 · C_behavior 0.40 · T_containment 0.54 · C_monitor 0.65 · T_calendar 0.74 · C_evidence 0.85. Binding term: C_event. dt_days = 81, measured from the primary public disclosure dated 2026-05-24 to the 2026-08-13 evidence reference date; the AIDEFEND brief republished the analysis on 2026-06-01. The campaign seeding window of 2026-05-19 through 2026-05-22 predates the public disclosure. BAW applies on two checklist items: the instruction files are cross-session persistent state that the agent chain writes (trap-core.js re-establishes persistence through .cursorrules and CLAUDE.md), and that constitutes agent-written configuration change. C_monitor 0.65 — the campaign ran from the May 19-22 seeding until Socket's June 1 disclosure with no detection of hidden-Unicode ingestion, secret-path reads or outbound egress from assistant sessions. C_event 0.35 — a confirmed compromise event, with live malicious artefacts in three production registries and credentials exfiltrated and validated by the attacker. C_behavior Band 0 (0.40) — no canaries, registered invariants, drift baseline or instruction-file write visibility are evidenced. C_evidence 0.85 — unresolved: poisoned instruction files may persist in repositories, CI caches and containers, and credential rotation status across the affected population is unknown. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.29 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-021.001 | Client-Side Configuration EnforcementParent AID-H-021 (AI Agent Configuration Integrity & Hardening), dataVersion 2026.08.05. The reconciled parent maps to Cn-2 and Cn-5; the Cn-2 leg is evidenced here, but the Cn-5 identity leg is not independently evidenced by this incident, so Cn-5 is not scored. The sub-technique's strongest evidence contribution in this case is to Ro-4 (validating instruction-file source, hidden characters and high-risk instructions before ingestion). | Very High | Cn-2 Cn-5 |
| AID-H-022.002 | Pre-Merge Dependency Change Risk ReviewParent AID-H-022 maps directly to Ro-4 in the reconciled AIDEFEND dataVersion 2026.08.05 crosswalk. Substantively the control governs pre-merge supply-chain review, which is adjacent to Ro-4 and Tr-4. | Very High | Ro-4 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisParent AID-D-001 (Adversarial Input, Prompt Injection & Signal-Authenticity Detection), dataVersion 2026.08.05. Directly supports Ro-1 = 0.25: no decoded-view inspection existed to surface the zero-width Unicode carrier. | High | Ro-1 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationParent AID-H-002 (AI-Contextualized Data Sanitization & Input Validation), dataVersion 2026.08.05. Only the Ro-1 leg is evidenced by this incident; the Fa-1 and Fa-3 legs of the parent mapping have no supporting evidence here and no fairness sub-metric is scored. | High | Fa-1 Fa-3 Ro-1 |
| AID-I-001.004 | Sandbox Network Egress RestrictionsParent AID-I-001 (AI Execution Sandboxing & Runtime Isolation), dataVersion 2026.08.05. The reconciled parent maps to Pr-2, which this incident does not evidence (no inference attack); the sub-technique's effect here is on Cn-1 (network scope) and Cn-6 (blocking the irreversible egress hop). Recorded without inventing a parent-level mapping. | High | Cn-7 Pr-2 |
| AID-H-022.001 | Sandboxed Dependency InstallationParent AID-H-022 maps directly to Ro-4 in the reconciled AIDEFEND dataVersion 2026.08.05 crosswalk. The Sandboxed Dependency Installation control is applied here as evidence for Ro-4. | High | Ro-4 |
| AID-M-009.002 | Authority Envelope & Action Risk ClassificationParent AID-M-009 (Agent Autonomy & Authority Governance), dataVersion 2026.08.05. Directly supports Cn-1 = 0.25, Cn-2 = 0.25 and Cn-6 = 0.00: classifying secret access, shell execution and network egress as outside the routine envelope is the missing control. The Cn-5 leg is not independently evidenced here. | High | Cn-1 Cn-5 Cn-6 Cn-7 |
| AID-M-001.002 | AI System Dependency MappingParent AID-M-001 (AI Asset Inventory & Mapping), dataVersion 2026.08.05. The Tr-4 leg supports the Tr-4 = 0.25 placement — knowing which repositories added .cursorrules or CLAUDE.md is configuration-lineage evidence. Cn-5 and Fa-3 legs are not evidenced here. | Medium | Cn-5 Fa-3 Tr-4 |
| AID-E-003.003 | Confirmed Malicious Code & Persistence EvictionParent AID-E-003 (Malicious AI Artifact Quarantine, Eviction & Recovery Routing), dataVersion 2026.08.05. Supports the Ro-4 = 0.00 placement: no quarantine or rollback-to-clean-baseline capability existed for poisoned instruction files, which is why cleanup must remove them manually alongside hooks, systemd units and cron entries. | Medium | Ro-4 |
WHAT THIS CASE TEACHES
Ro-4 poisoning resistance is not only about training data and RAG corpora: an agent's own instruction and configuration files are an ingestion channel, and where they are read as authoritative guidance with no provenance, signature or hidden-character check, Ro-4 sits at the 0.00 anchor regardless of how well the training pipeline is protected.
Sources: AIDEFEND in Action brief — TrapDoor: Poisoned .cursorrules and CLAUDE.md Turn AI Coding Assistants Into Credential Stealers · Primary source — TrapDoor: Crypto Stealer Supply Chain Attack Hits 34 Packages Across npm, PyPI, and Crates.io (2026-05-24)