Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-05-19

HighPrimary

TrapDoor Cross-Ecosystem Supply Chain: 34 Packages Planted Hidden AI Instructions in CLAUDE.md and .cursorrules to Poison Coding Assistants on Developer Machines

34 malicious packages (npm/PyPI/Crates.io) targeting crypto, DeFi, Solana, and AI developers. Novel: planted .cursorrules and CLAUDE.md files with hidden zero-width Unicode instructions to poison AI coding assistants on same machine. Universal AI Agent Extraction Framework. 384 artifact versions.

Claude Code / CursorTool execution / MCPSupply chain: AI coding assistant configuration poisoning via hidden instructionsDeveloper machines / AI coding assistants (Claude Code, Cursor)

What happened

TrapDoor packages installed CLAUDE.md and .cursorrules files with hidden zero-width Unicode characters encoding malicious instructions. AI coding assistants on the same machine read these files and followed the hidden instructions — the 'Universal AI Agent Extraction Framework' — harvesting credentials, private keys, and wallet data.

Why it matters

Developer credentials, cryptocurrency private keys, and wallet data harvested from affected developer machines. 34 packages across 384 versions spanning npm, PyPI, and Crates.io. Targeted crypto, DeFi, Solana, and AI developers — high-value credential targets for financial exploitation.

Missing authorization check

Not applicable: no agent authorization boundary was crossed in this incident.

Would PP block it?

The compromise ran through package, credential, or vendor infrastructure rather than through an agent tool call, so there is no agent action for an authorization gate to hold.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-05-19

    TrapDoor campaign begins: 34 malicious packages distributed across npm, PyPI, and Crates.io. Packages install CLAUDE.md and .cursorrules files with hidden zero-width Unicode AI poisoning instructions.

  2. 2026-05-22

    TrapDoor campaign detected. 384 artifact versions identified and removed from registries. Universal AI Agent Extraction Framework payload documented.

Technical breakdown

  • Packages installed .cursorrules and CLAUDE.md files containing zero-width Unicode characters that are invisible when viewing file contents normally.
  • Zero-width characters encoded malicious instructions that AI coding assistants processed as part of the instruction context.
  • The 'Universal AI Agent Extraction Framework' instructions directed AI assistants to harvest credentials, private keys, and wallet data from the developer's machine.
  • Cross-ecosystem distribution (npm/PyPI/Crates.io) ensured broad reach across different developer communities.
  • 384 artifact versions across 34 packages created redundancy against individual package takedowns.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Credential read gate, file exfiltration gate, consequential action authorization
Still needs
Trust verification for CLAUDE.md and .cursorrules from third-party packages; hidden Unicode detection in instruction files
Receipt required for
Any action instructed by CLAUDE.md or .cursorrules not explicitly authored by the developer, credential file reads

No agent took an action in this incident. Permission Protocol gates what an agent does, so it does not apply where the harm required no agent action.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop