GCVE-110-OSM-2026-8504

Malicious Crates.io package 'sui-framework-helpers' is part of the TrapDoor cross-registry supply chain attack documented by Socket on 2026-05-24. The package executes a shared credential-stealing payload that exfiltrates SSH keys, AWS/GitHub tokens, browser data, and crypto wallets (Solana, Sui, Aptos) to attacker infrastructure at ddjidd564.github.io, and plants persistence via shell hooks, systemd, cron, and AI-assistant config files (.cursorrules, CLAUDE.md). Malicious payload triggered by Rust build.rs script at compile time. Loads shared trap-core.js logic; harvests SSH keys, AWS/GitHub credentials, wallet extension data (Solana, Sui, Aptos), env vars, and developer configs. Wallet data encrypted with XOR before exfil. Pulls C2 config from https://ddjidd564.github.io/defi-security-best-practices/config.json. Persistence via shell/git hooks, systemd, cron. AI-targeted injection into .cursorrules and CLAUDE.md using zero-width Unicode. Campaign marker: P-2024-001.