TrapDoor disguised credential stealers as AI and security developer tools

Socket linked more than 34 malicious packages and 384 related versions or artifacts across npm, PyPI and Crates.io to the campaign it named TrapDoor. Package names such as llm-context-compressor, model-switch-router, prompt-engineering-toolkit and wallet-security-checker resembled ordinary development, security and AI utilities. The execution path differed by ecosystem: npm packages used lifecycle hooks, PyPI packages could download and execute remote JavaScript on import, and Rust packages used build.rs during compilation. The shared objective included theft of SSH keys, cloud credentials, GitHub tokens, browser data and cryptocurrency wallet material.

TrapDoor also targeted the AI development layer after package placement. Socket found hidden zero-width instructions in .cursorrules and CLAUDE.md intended to make coding assistants run a benign-looking security workflow that led toward secret discovery and exfiltration, and it documented campaign-linked pull requests attempting to add those files to legitimate AI and developer projects. That is direct evidence of attacker intent and observed instruction planting, but not a universal success claim. Socket cautions that the technique may not work consistently across every tool and model and does not publish a measured count of assistants successfully induced to execute the hidden workflow.

npm v12's default blocking of unapproved dependency lifecycle scripts narrows the npm postinstall branch. It does not address TrapDoor's PyPI import behavior, Rust build execution, or later agent behavior driven by malicious project instructions. The campaign therefore crosses several trust boundaries rather than depending on one package-manager feature.