{
 "tag": "claude-code",
 "name": "Claude Code",
 "group": "Other",
 "incidents": [
  {
   "slug": "trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "title": "TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools",
   "url": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "json": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The packages planted .cursorrules and CLAUDE.md files with hidden Unicode instructions meant to trick AI coding assistants into running steps that could find and exfiltrate secrets."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "Developers installing packages from npm, PyPI and Crates.io",
   "tags": [
    "multi-evm",
    "supply-chain",
    "trapdoor",
    "npm",
    "pypi",
    "crates-io",
    "ai-coding-agent",
    "cursor",
    "claude-code",
    "hidden-unicode",
    "infostealer",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-05-26",
   "closedAt": "2026-05-26",
   "updatedAt": "2026-05-26T12:00:00Z",
   "summary": "Socket reported in late May 2026 a campaign it named TrapDoor: more than 34 malicious packages and 384+ related versions across npm, PyPI and Crates.io that steal crypto wallet data and other developer secrets. The packages also tried to alter files that AI coding tools read, such as .cursorrules and CLAUDE.md, using hidden Unicode instructions meant to get the assistant to run scan-like steps that find and send out secrets. No confirmed losses or victim counts have been published. Developers who installed flagged packages should rotate credentials and move wallet funds."
  },
  {
   "slug": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "title": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "json": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "The malware ran locally installed AI CLIs (Claude, Gemini, Amazon Q) to inventory wallet, keystore and secret files for theft; Wiz found the AI step worked in under a quarter of cases and saw no successful crypto exfiltration."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "Nx build system on npm",
   "tags": [
    "multi-evm",
    "supply-chain",
    "nx",
    "npm",
    "s1ngularity",
    "ai-cli",
    "claude-code",
    "gemini-cli",
    "amazon-q",
    "keystore",
    "github-tokens",
    "github-actions",
    "infostealer",
    "wiz",
    "ai"
   ],
   "amountUsd": null,
   "victims": 1700,
   "startedAt": "2025-08-26",
   "closedAt": "2025-09-06",
   "updatedAt": "2025-09-06T12:00:00Z",
   "summary": "Around 26 August 2025 malicious versions of Nx, a widely used JavaScript build tool, were published to npm and stole GitHub and npm tokens on install. The malware also looked for installed AI command-line tools (Claude, Gemini and Amazon Q) and ran them to search the disk for crypto wallet and keystore files, .env files and SSH keys, then published the results to repos in the victim's own GitHub account. Wiz counted over 1,700 users with leaked secrets and over 6,700 private repos made public, but saw no successful crypto theft, partly because the AI tools often refused. Anyone who installed the bad versions should rotate tokens and move funds from wallet files on that machine."
  }
 ],
 "changes": [
  {
   "incident": "trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026",
   "incidentTitle": "TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-26",
   "title": "CSO Online reported Socket's TrapDoor findings: 34+ malicious packages across three registries that steal wallet data and poison AI assistant config files.",
   "sourceUrl": "https://www.csoonline.com/article/4177019/trapdoor-malware-campaign-puts-developer-workstations-in-ciso-spotlight.html",
   "url": "https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-09-06",
   "title": "BleepingComputer reported Wiz's tally of 2,180 exposed accounts and 7,200 repositories across three phases.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack/",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-09-03",
   "title": "Wiz published its analysis: over 1,700 users had secrets leaked, over 6,700 private repos were exposed, and no successful crypto exfiltration had been seen.",
   "sourceUrl": "https://www.wiz.io/blog/s1ngularitys-aftermath",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-08-26",
   "title": "News broke that malicious Nx versions on npm were stealing tokens and using local AI CLIs to search for wallet and secret files.",
   "sourceUrl": "https://www.wiz.io/blog/s1ngularitys-aftermath",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  },
  {
   "incident": "nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025",
   "incidentTitle": "Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-08-26",
   "title": "Malicious Nx versions with a data-stealing postinstall script were published to npm.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ai-powered-malware-hit-2-180-github-accounts-in-s1ngularity-attack/",
   "url": "https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025"
  }
 ]
}