TrapDoor Hides Instructions Inside CLAUDE.md Using Characters You Can't See

Researchers identified an active supply-chain campaign around May 22, 2026, tracked as TrapDoor, built around 34 malicious packages spread across npm (21), PyPI (7), and Crates.io (6), with more than 384 versions published between them. The packages steal SSH keys, AWS credentials, and crypto wallets, which by itself puts them in familiar territory for supply-chain attacks.

What makes TrapDoor different is its payload, a script called trap-core.js that plants hidden instructions inside CLAUDE.md and .cursorrules files, the configuration files that Claude Code and Cursor read automatically to understand project context. The instructions are written using zero-width Unicode characters, invisible to anyone reading the file in a normal editor or reviewing it in a pull request.

When Claude Code or Cursor parses that project context as part of a routine session, the agent picks up the hidden instructions and runs what looks, from the visible output, like an ordinary security scan. What it is actually doing is silently exfiltrating whatever secrets it can reach. No CVE has been assigned to the technique, and according to The Hacker News, Phoenix Security, and GridinSoft, traditional security scanners see nothing wrong with the poisoned files, because there is nothing visibly wrong with them.

The practical defense is inspecting configuration files that agents read automatically, CLAUDE.md and .cursorrules included, for non-printing or zero-width characters, not just for the readable text they contain. A file can pass every human read-through and still carry instructions no scanner or reviewer would catch.