TrapDoor relied on 34+ lookalike utility packages being added to projects. Before a pull request adds one, require vulnerability, license, maintainer and repository reputation, release provenance, install-script diff, and typo or homoglyph checks for the exact package and lockfile change. Missing analysis must block merge. This catches source-change risk before installation; malware analysis of exact package bytes and containment of postinstall or import-time execution remain separate controls.
Enforce default-deny sandbox egress for agent commands, dependency installation and builds, and independently test all execution paths. The source identifies GitHub Pages as a payload/configuration host and GitHub Gists as a Rust exfiltration destination; do not assume the static Pages site receives stolen credentials. Allowing a registry or shared hosting domain is insufficient without checking the exact required paths and preventing upload/relay abuse.
Run untrusted dependency installation and any required import/build execution in an ephemeral sandbox without developer-home mounts, SSH material or production secrets. Disable npm lifecycle scripts where possible. Python import code and Rust build.rs need separate execution isolation or package rejection; there is no universal flag that disables all three execution paths.
An assistant that reads SSH keys or wallet files, runs a "scan," and makes outbound calls is performing high-risk actions whatever the prompt calls them. Classify secret access, shell execution, and network egress as outside the routine envelope; runtime approval, tool, and egress controls consume those facts and own refusal.
Use endpoint content checks and exact staged-blob review as early signals, with central CI as the merge gate. The published hook covers CLAUDE.md and agent_config.md and two dangerous phrases; it does not cover .cursorrules, decode hidden Unicode, validate remote guidance or prove instruction safety. Extend and independently test the exact file and policy coverage for this campaign, and deny unreviewed changes before an assistant consumes them.
At an operator-controlled ingress, G001 can apply a pinned, calibrated secondary classifier to the exact instruction-file text admitted to the coding assistant and emit a content-bound finding for task redirection, authority claims or privilege escalation. G001 does not decode zero-width carriers or compare raw and rendered views. The current G002 decoder cannot initialize and is not credited here. A finding supplies evidence; a separate admission policy owns refusal. Plausible or concealed instructions can evade classification. Independently validate the complete classifier result and required category coverage before admission. The current G001 sample returns PASS/NO_FINDING for empty output, missing categories or NaN scores; treat those conditions as errors and refuse admission. This validation is an additional integration guard, not behavior already supplied by the published sample.
Apply the published field-specific validation and Unicode policy at the exact instruction-file ingress, before constructing the inference request. Reject forbidden characters or findings under the signed admission policy. Normalization and pattern checks can miss semantic task switching and do not turn repository instructions into trustworthy authority; tool and egress enforcement remain necessary.
Once TrapDoor indicators are known, dependency mapping helps turn them into a scoped investigation: which projects or lockfiles reference malicious packages, which repos added .cursorrules or CLAUDE.md, and which CI caches, containers, or developer machines may have touched those artifacts. This is a supporting inventory control: it turns an IOC list into trackable cleanup work rather than detecting or blocking the attack by itself.
Remove incident-confirmed malicious instruction files, package payloads, Git/shell hooks, systemd/cron entries and attacker-added SSH access, then verify the exact affected population is clean. Credential revocation and issued-token/session eviction are separate response operations; do not count uninstalling a package as their completion.