{
  "entry": {
    "kind": "vuln",
    "slug": "trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant",
    "name": "trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant",
    "vendor": "Cross-Ecosystem Supply Chain Attack Poisons AI Assistant Con",
    "description": "TrapDoor planted 34 malicious packages across 384 versions on npm, PyPI, and Crates.io, disguised as developer tools and security scanners and aimed at crypto, DeFi, Solana, and AI developers. Beyond conventional credential theft it drops .cursorrules and CLAUDE.md files carrying instructions hidden with zero-width Unicode (U+200B/200C/200D/FEFF), invisible to humans but parsed by Cline, Cursor, and Claude Code, which then run a fake \"security scan\" that silently exfiltrates local secrets. The campaign began May 19, 2026 and is not detectable by traditional vulnerability scanners (no CVE).",
    "website": "https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-05-25",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant",
      "aliases": [
        "ti-030"
      ],
      "title": "TrapDoor: Cross-Ecosystem Supply Chain Attack Poisons AI Assistant Config Files",
      "summary": "TrapDoor planted 34 malicious packages across 384 versions on npm, PyPI, and Crates.io, disguised as developer tools and security scanners and aimed at crypto, DeFi, Solana, and AI developers. Beyond conventional credential theft it drops .cursorrules and CLAUDE.md files carrying instructions hidden with zero-width Unicode (U+200B/200C/200D/FEFF), invisible to humans but parsed by Cline, Cursor, and Claude Code, which then run a fake \"security scan\" that silently exfiltrates local secrets. The campaign began May 19, 2026 and is not detectable by traditional vulnerability scanners (no CVE).",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Supply chain compromise",
        "Credential theft"
      ],
      "componentType": "agent",
      "component": {
        "name": "Cross-Ecosystem Supply Chain Attack Poisons AI Assistant Con",
        "vendor": null,
        "package": null,
        "ecosystem": "npm",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "34 malicious npm/PyPI/Crates.io packages (384 versions), live from May 19, 2026",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-05-25",
      "modifiedAt": "2026-05-25",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html"
        }
      ],
      "mitigation": "Audit lockfiles against the 34 IOC packages. Grep .cursorrules and CLAUDE.md files for zero-width Unicode characters. Rotate SSH keys, AWS credentials, GitHub tokens, and crypto wallet keystores on affected machines. Block outbound traffic to ddjidd564.github.io. Remove persistence artifacts (git hooks, cron jobs, systemd services).",
      "detectedByAnomity": true
    }
  }
}