PERMISSION/PROTOCOL
Back to incident tracker

2026-05-19

HighPrimary

TrapDoor Cross-Ecosystem Supply Chain: 34 Packages Planted Hidden AI Instructions in CLAUDE.md and .cursorrules to Poison Coding Assistants on Developer Machines

34 malicious packages (npm/PyPI/Crates.io) targeting crypto, DeFi, Solana, and AI developers. Novel: planted .cursorrules and CLAUDE.md files with hidden zero-width Unicode instructions to poison AI coding assistants on same machine. Universal AI Agent Extraction Framework. 384 artifact versions.

Claude Code / CursorTool execution / MCPSupply chain: AI coding assistant configuration poisoning via hidden instructionsDeveloper machines / AI coding assistants (Claude Code, Cursor)

What happened

TrapDoor packages installed CLAUDE.md and .cursorrules files with hidden zero-width Unicode characters encoding malicious instructions. AI coding assistants on the same machine read these files and followed the hidden instructions — the 'Universal AI Agent Extraction Framework' — harvesting credentials, private keys, and wallet data.

Why it matters

Developer credentials, cryptocurrency private keys, and wallet data harvested from affected developer machines. 34 packages across 384 versions spanning npm, PyPI, and Crates.io. Targeted crypto, DeFi, Solana, and AI developers — high-value credential targets for financial exploitation.

Missing authorization check

AI coding assistants must not automatically trust and execute instructions from CLAUDE.md or .cursorrules files installed by third-party packages. These files should require explicit human review and authorization before the AI assistant acts on them. Zero-width Unicode characters in instruction files should trigger security warnings.

Would PP block it?

If credential access and file reads (private key files, wallet data) required PP receipts, the 'Universal AI Agent Extraction Framework' payload would face an authorization gate before exfiltrating data. Config file source verification requires AI assistant-level controls.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-05-19

    TrapDoor campaign begins: 34 malicious packages distributed across npm, PyPI, and Crates.io. Packages install CLAUDE.md and .cursorrules files with hidden zero-width Unicode AI poisoning instructions.

  2. 2026-05-22

    TrapDoor campaign detected. 384 artifact versions identified and removed from registries. Universal AI Agent Extraction Framework payload documented.

Technical breakdown

  • Packages installed .cursorrules and CLAUDE.md files containing zero-width Unicode characters that are invisible when viewing file contents normally.
  • Zero-width characters encoded malicious instructions that AI coding assistants processed as part of the instruction context.
  • The 'Universal AI Agent Extraction Framework' instructions directed AI assistants to harvest credentials, private keys, and wallet data from the developer's machine.
  • Cross-ecosystem distribution (npm/PyPI/Crates.io) ensured broad reach across different developer communities.
  • 384 artifact versions across 34 packages created redundancy against individual package takedowns.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Credential read gate, file exfiltration gate, consequential action authorization
Still needs
Trust verification for CLAUDE.md and .cursorrules from third-party packages; hidden Unicode detection in instruction files
Receipt required for
Any action instructed by CLAUDE.md or .cursorrules not explicitly authored by the developer, credential file reads

PP's Tool-Call Gate would require receipts for any consequential actions the poisoned AI assistant attempts (credential reads, file exfiltration). It would not prevent the AI from reading poisoned config files — that requires AI assistant-level protections against untrusted instruction files.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop