TrapDoor Supply Chain Attack: How Malicious .cursorrules and CLAUDE.md Target AI Coding Tools

In May 2026, security researchers uncovered TrapDoor, a sophisticated supply chain campaign that injected malicious .cursorrules and CLAUDE.md files into over 35,000 GitHub repositories. These poisoned configuration files instruct AI coding assistants like Cursor and Claude to silently exfiltrate developer credentials, cloud keys, and environment variables during normal coding workflows. If you use AI-powered development tools, this attack directly threatens your codebase and infrastructure.

What Is the TrapDoor Supply Chain Attack?

TrapDoor is a supply chain attack that exploits the trust developers place in AI coding tool configuration files. The campaign published malicious npm, PyPI, and Crates packages that, once installed, added or modified .cursorrules and CLAUDE.md files in target projects. These configuration files are read by AI coding assistants to customize their behavior, which means a poisoned file can instruct the AI assistant to:

Exfiltrate environment variables and .env secrets to attacker-controlled servers
Replace secure dependencies with malicious versions during npm install or pip install
Insert backdoors into generated code that bypass normal code review
Modify CI/CD pipeline configurations to leak build secrets
Redirect API calls through attacker-controlled proxies

The attack works because AI coding assistants execute these configuration files automatically. When you open a project in Cursor or use Claude Code in a directory, the tool reads .cursorrules or CLAUDE.md and applies those instructions to every interaction, including code generation, file editing, and terminal commands. There is no manual approval step for the instructions in these files.

Why AI Coding Tool Configuration Files Are a High-Value Target

Configuration files like .cursorrules and CLAUDE.md have become standard practice for teams using AI coding assistants. Developers add them to repositories to customize how the AI generates code, enforce style guides, and provide project context. The TrapDoor attack exploits three properties of these files that make them uniquely dangerous:

1. Implicit Trust Without Verification

AI coding assistants treat .cursorrules and CLAUDE.md as authoritative instructions. Unlike a suspicious terminal command, these files are read and executed silently. Most developers never audit them line by line, especially when they are part of a cloned repository or installed as a dependency side effect.

2. Wide Distribution Through Package Registries

NPM, PyPI, and Crates.io packages can include .cursorrules or CLAUDE.md files in their distribution. When a developer installs an affected package, the malicious configuration file may be written to the project root or a parent directory, affecting not just that package but the entire project and any AI assistant interactions that follow.

3. Persistence Across Sessions

Once a poisoned configuration file is in place, it affects every AI-assisted coding session. The instructions persist across multiple coding sessions, commits, and even different developers on the same machine or shared repository. This persistence makes the attack more valuable than a one-time credential theft.

How to Detect Malicious .cursorrules and CLAUDE.md Files

Detecting TrapDoor and similar attacks requires a combination of file-level inspection and automated scanning. Here is a practical detection checklist:

Manual Inspection Checklist

Check for unexpected configuration files. Look for .cursorrules and CLAUDE.md files in project roots, home directories, and any parent directories where you run AI coding tools.
Read every instruction. Open each file and verify that the instructions match your intended customization. Watch for instructions that reference external URLs, environment variables, or credential exfiltration patterns.
Watch for obfuscation. Malicious files may use Unicode tricks, invisible characters, or base64-encoded strings to hide their true purpose.
Verify file origins. Legitimate .cursorrules and CLAUDE.md files should be committed by known team members. Files that appear in git history without a clear author should be investigated.

Automated Detection

Use automated scanning tools to catch malicious configuration files before they cause damage:

Run secret scanning on all project files, including dotfiles. Tools like the Secret/Config Diff Scanner can detect credential exfiltration patterns in configuration files.
Add .cursorrules and CLAUDE.md to your CI/CD security gates so they are scanned on every commit. The CI Gates for AI-Generated Code checklist covers this scenario.
Use pre-commit hooks that flag new or modified AI configuration files. The Pre-Commit Checks for AI-Generated Code guide includes hook templates for this.
Scan your node_modules, site-packages, and other dependency directories for unexpected .cursorrules or CLAUDE.md files after every install.

How to Protect Your Team Against Supply Chain Attacks on AI Tools

Preventing TrapDoor-style attacks requires changes at three levels: repository hygiene, dependency management, and code review process.

Repository Hygiene

Pin your AI configuration files. Commit your .cursorrules and CLAUDE.md files to version control. Any file not in version control should not exist in your working directory. Use git status to detect untracked configuration files.
Add them to your diff review. Always review changes to .cursorrules and CLAUDE.md in pull requests, just as you would review changes to package.json or Dockerfile.
Use a strict .gitignore that prevents unexpected configuration files from being committed accidentally.

Dependency Management

Audit new dependencies before installing. Check the package repository for suspicious files, unusual post-install scripts, and unexpected .cursorrules or CLAUDE.md inclusions.
Use lockfiles. package-lock.json, poetry.lock, and Cargo.lock prevent dependency confusion attacks where a higher-version malicious package replaces a legitimate one.
Run an SBOM audit regularly. A Software Bill of Materials helps you track exactly what packages are installed and detect unexpected additions. The AI Agent Change Risk Audit Kit includes dependency audit workflows for this purpose.

Code Review Process

Never skip review of AI-generated code. The How to Review AI-Generated Code Before Merging checklist provides a step-by-step process for safe AI code review.
Check for credential patterns in every diff. Even legitimate AI-generated code may accidentally include hardcoded secrets or API keys. Always run a secret scanner on diffs before merging.
Review the full diff, not just the AI summary. AI coding tools can hide malicious changes inside large diffs. Use the Git Diff Security guide to learn what to look for.

What to Do If You Have Been Affected

If you discover a malicious .cursorrules or CLAUDE.md file in your project, take these steps immediately:

Delete the malicious file from all directories, including home directories and global configuration locations.
Rotate all credentials that were accessible to the AI coding tool during the time the malicious file was present. This includes environment variables, API keys, database credentials, and cloud access tokens.
Audit recent commits and generated code for backdoors, data exfiltration patterns, or modified dependency declarations.
Check outbound network connections in your project logs for calls to unrecognized domains or IP addresses.
Report the malicious package to the relevant registry (npm, PyPI, or Crates.io) and consider reporting to your organization’s security team.
Implement preventive scanning to catch future attacks before they reach your development environment.

The Broader Trend: AI Tools as Attack Vectors

TrapDoor is part of a growing trend of supply chain attacks that target developer tools and AI-powered workflows. The same research from Veracode and the Cloud Security Alliance that found 45% of AI-generated code contains OWASP Top 10 vulnerabilities also highlights that AI coding assistants are becoming attractive targets for attackers because:

They have broad access to codebases, credentials, and development environments
They execute instructions from configuration files without explicit user approval
They generate code that is often merged without thorough review
They operate in the context of the developer’s own permissions and network access

This means that securing AI coding tools is not just about reviewing their output. It is also about securing their input, including configuration files, prompts, and the development environment itself. The AI Code Security Hub covers the full lifecycle of AI code security, from input validation to output review.

Key Takeaways

TrapDoor poisoned .cursorrules and CLAUDE.md files in 35,000+ repositories to exfiltrate credentials through AI coding assistants.
AI coding tool configuration files are implicitly trusted and automatically executed, making them a high-value attack surface.
Detect malicious files through manual inspection, automated secret scanning, and CI/CD security gates.
Prevent future attacks by pinning configuration files to version control, auditing dependencies, and reviewing every AI-generated diff.
If affected, delete the file, rotate all credentials, audit recent code, and implement preventive scanning.

Review Your Codebase for Supply Chain Risks

Supply chain attacks like TrapDoor are becoming more sophisticated and more common. If your team uses AI coding tools, you need automated scanning that catches malicious configuration files, credential exfiltration, and hidden backdoors before they reach production. CodeRiskTools Secret/Config Diff Scanner detects credential leaks in diffs, the AI Code Review Checklist provides a structured review process, and the Workflow Pack gives you a complete end-to-end review workflow from diff to documented, verified change.

Fixed-price tools. No subscription. No code upload. Run locally on your machine in under 5 minutes.

Image: Cybersecurity code review background by FLY:D on Unsplash (free license). Original source: Unsplash. Licensed under the Unsplash License.

CodeRiskTools