TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools
Developers installing packages from npm, PyPI and Crates.io
Socket reported in late May 2026 a campaign it named TrapDoor: more than 34 malicious packages and 384+ related versions across npm, PyPI and Crates.io that steal crypto wallet data and other developer secrets. The packages also tried to alter files that AI coding tools read, such as .cursorrules and CLAUDE.md, using hidden Unicode instructions meant to get the assistant to run scan-like steps that find and send out secrets. No confirmed losses or victim counts have been published. Developers who installed flagged packages should rotate credentials and move wallet funds.
Why this severity: Only partly contained, many people exposed.
AI involvement
AI agents as the target. The packages planted .cursorrules and CLAUDE.md files with hidden Unicode instructions meant to trick AI coding assistants into running steps that could find and exfiltrate secrets.
Give agents a small, capped wallet with allow-listed destinations, and never let an agent that can sign read untrusted content.
- Started
- May 26, 2026
- Closed
- May 26, 2026
- Chains
- Multiple EVM chains
- Method
- Supply-chain stealers
At risk
- Developers installing packages from npm, PyPI and Crates.io
- Multiple EVM chains wallets
What to do now
- Check lockfiles against the published TrapDoor package list and remove any matches.
- Rotate SSH keys and cloud and GitHub tokens, and move funds from wallets whose keys or files were on that machine.
- Open .cursorrules and CLAUDE.md files in an editor that shows hidden characters and delete any you did not write.
Stay safe
Am I affected?
You may be affected if you installed crypto, DeFi or 'security scanner' packages from npm, PyPI or Crates.io in May 2026 that appear on Socket's TrapDoor list, or if unexpected .cursorrules or CLAUDE.md files showed up in your projects.
What to do now
- Check lockfiles against the published TrapDoor package list and remove any matches.
- Rotate SSH keys and cloud and GitHub tokens, and move funds from wallets whose keys or files were on that machine.
- Open .cursorrules and CLAUDE.md files in an editor that shows hidden characters and delete any you did not write.
How to avoid this
- Review AI assistant config files in repos as carefully as code, and don't let assistants run commands without approval.
- Keep wallet keys off development machines; use hardware wallets.
- Pin dependencies and scan new packages before installing them.
Timeline 1
CSO Online reported Socket's TrapDoor findings: 34+ malicious packages across three registries that steal wallet data and poison AI assistant config files.
Source
News & write-ups ›1
How this method works
A popular code package or app update is hijacked to steal wallet keys or swap addresses, hitting everyone who installs it. Read about supply-chain stealers →
Follow new drains and updates in your feed reader or Telegram RSS bot.