Hackers Are Now Poisoning Your CLAUDE.md File to Steal Your AWS Keys. The TrapDoor Attack Targets AI Developers Specifically.

On May 22, 2026 at 8:20 PM UTC, the first package in a coordinated supply chain campaign hit PyPI. By the end of that week, 34 malicious packages had spread across npm, PyPI, and Crates.io in 384 versions, exfiltrating SSH keys, AWS credentials, GitHub tokens, and crypto wallet keystores from developers who installed them. The campaign was named TrapDoor.

The novel part isn't the credential theft. It's how the attackers targeted AI developers specifically: by poisoning .cursorrules and CLAUDE.md files submitted via GitHub pull requests, tricking Claude Code and Cursor into running what looked like a "security scan" that actually discovered and shipped your secrets to an attacker-controlled endpoint.

If you're a solo operator using AI coding tools, the configuration files you rely on most are now an active attack surface.

What TrapDoor actually did

The campaign targeted three communities: crypto/DeFi/Solana developers, Solana infrastructure builders, and AI middleware developers. The package names were designed to look like legitimate security and developer tooling: names like eth-security-auditor, solana-validator-tools, and ai-context-manager.

Across the 34 packages and 384 versions, the payload varied by ecosystem:

PyPI packages auto-executed on import. They downloaded a JavaScript payload from an attacker-controlled GitHub Pages domain and ran it via node -e: meaning the Python package delegated the actual damage to a remote script the attacker could update after publication.

Crates.io packages abused build.rs, which executes automatically during Rust compilation. The script located local keystores, XOR-encrypted them with the hardcoded key cargo-build-helper-2026, and exfiltrated them to GitHub Gists where the attacker could collect them.

npm packages used a combination of postinstall hooks and dependency confusion attacks against popular AI framework package names.

The exfiltrated data included SSH keys, AWS credentials and access tokens, GitHub personal access tokens, Sui, Solana, and Aptos wallet keystores, browser login databases (Chrome, Firefox, Brave), crypto wallet extension data, .env files, and local development configuration. If it was sitting in your home directory or project root, it was in scope.

The CLAUDE.md / .cursorrules angle is the part that's new

Attackers didn't just plant malicious packages. They also opened pull requests against popular open-source AI repositories (specifically browser-use/browser-use, langchain-ai/langchain, and langflow-ai/langflow) with subtle changes to .cursorrules or CLAUDE.md files.

These files contain instructions that AI coding assistants read at startup. Cursor reads .cursorrules. Claude Code reads CLAUDE.md. They're the configuration layer that tells the AI tool how to behave in a project.

The injected instructions, buried in what looked like documentation or formatting guidance, told the AI assistant to run a "security scan" when it detected certain directory structures. The scan itself was a series of shell commands: find ~/.ssh, env | grep -i aws, cat ~/.config/solana/id.json, piped to an exfiltration endpoint.

If you had one of these repos checked out locally and your AI coding tool was running with execute permissions, the attack could trigger without you opening the malicious package at all. You just had to have merged or pulled a branch that included the poisoned config file.

Socket (the supply chain security company that caught this campaign) detected the initial TrapDoor packages with a median response time of 5 minutes and 27 seconds after publication. The fastest detection was 58 seconds. That detection speed matters, but 58 seconds is enough time to install a package if you're moving fast.

Why solo operators are specifically in the crosshairs

Enterprise security teams review PRs and run package audits on CI. Solo operators typically don't have either. You're moving fast, you trust the packages you've used before, and you're likely running Claude Code or Cursor with file system access in a directory that includes .env, SSH keys, and AWS credentials.

The attack surface is: (1) you install a package from PyPI/npm/Crates.io that auto-executes on install or import; or (2) someone opens a PR to your project that modifies your AI config file and you merge it without inspecting the config changes carefully; or (3) you have a repo checked out that already has a poisoned config from an upstream contribution.

Option 3 is the one that requires the least action from you.

The 20-minute audit

If you work with crypto, DeFi, or AI middleware packages, or if you've recently pulled from browser-use, langchain, or langflow main branches:

Check your CLAUDE.md files. Run find . -name "CLAUDE.md" -not -path "*/node_modules/*" in your project roots. Read every one of them. Look for shell commands, find invocations, curl calls, or base64 encoding. A CLAUDE.md file should contain documentation instructions, not executable code.

Check your .cursorrules files. Same audit. Run find . -name ".cursorrules". These should contain formatting preferences and code style guidance. Anything that looks like a shell pipeline is a red flag.

Review recent PRs that touched config files. If a PR touched .cursorrules, CLAUDE.md, pyproject.toml, Cargo.toml, or package.json in the last two weeks, look at the diff specifically on those files.

Rotate your credentials if you're unsure. AWS, GitHub, and SSH keys are all rotatable in under 10 minutes. If you have any doubt that your environment was clean during this window, rotate them now. The cost of rotation is low. The cost of finding out you should have rotated is high.

Use Socket or pip-audit for dependency scanning. Socket has a free tier that checks npm and PyPI packages for known malicious patterns. pip-audit is the Python-native option. Neither is perfect, but both would have flagged the TrapDoor packages.

The honest take

The .cursorrules and CLAUDE.md poisoning vector is genuinely new. Before TrapDoor, supply chain attacks targeted the package itself. This attack targeted the configuration files that tell your AI tool what to do: which means it works even if the package never runs, as long as the config file gets executed by your AI assistant.

The structural problem is that AI coding tools have legitimate reasons to execute code (running tests, building projects, fixing failing CI steps), and the line between "the AI ran my build command" and "the AI ran a credential-exfiltration script" is invisible if you're not reading every command the AI executes.

The fix isn't to stop using AI tools. It's to treat your CLAUDE.md and .cursorrules files with the same review discipline you'd apply to code. They're executable artifacts now. Treat them that way.

Author

Lukas

@lukcombinator

Sources

• TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO — The Hacker News
• TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages — Socket
• Crypto and AI Developers Hit by TrapDoor Malware Supply Chain Attack — BanklessTimes
• Supply Chain Attack Compromises 34 Packages Across npm, PyPI, Crates — CyberPress