TrapDoor: Cross-Ecosystem Supply Chain Attack Poisons AI Assistant Config Files
TrapDoor: Cross-Ecosystem Supply Chain Attack Poisons AI Assistant Config Files is a critical-severity prompt injection issue in Cross-Ecosystem Supply Chain Attack Poisons AI Assistant Con, an AI agent. Affected: 34 malicious npm/PyPI/Crates.io packages (384 versions), live from May 19, 2026.
Is Cross-Ecosystem Supply Chain Attack Poisons AI Assistant Con running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant- Severity
- critical
- Attack type
- Prompt injection, Supply chain compromise, Credential theft
- Component
- Cross-Ecosystem Supply Chain Attack Poisons AI Assistant Con · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
TrapDoor planted 34 malicious packages across 384 versions on npm, PyPI, and Crates.io, disguised as developer tools and security scanners and aimed at crypto, DeFi, Solana, and AI developers. Beyond conventional credential theft it drops .cursorrules and CLAUDE.md files carrying instructions hidden with zero-width Unicode (U+200B/200C/200D/FEFF), invisible to humans but parsed by Cline, Cursor, and Claude Code, which then run a fake "security scan" that silently exfiltrates local secrets. The campaign began May 19, 2026 and is not detectable by traditional vulnerability scanners (no CVE).
Affected versions
| Affected | Fixed in |
|---|---|
34 malicious npm/PyPI/Crates.io packages (384 versions), live from May 19, 2026 | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run 34 malicious npm/PyPI/Crates.io packages (384 versions), live from May 19, 2026.
How do I fix it?
Audit lockfiles against the 34 IOC packages. Grep .cursorrules and CLAUDE.md files for zero-width Unicode characters. Rotate SSH keys, AWS credentials, GitHub tokens, and crypto wallet keystores on affected machines. Block outbound traffic to ddjidd564.github.io. Remove persistence artifacts (git hooks, cron jobs, systemd services).
How do I find every machine running Cross-Ecosystem Supply Chain Attack Poisons AI Assistant Con?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Cross-Ecosystem Supply Chain Attack Poisons AI Assistant Con and which version, then enforce a policy on it.