TrapDoor Malware Used npm, PyPI, and Rust Packages to Steal Crypto Wallets and Cloud Credentials

Key Takeaways

TrapDoor malware spread through 34 malicious packages across npm, PyPI, and Crates.io, targeting crypto, DeFi, AI, and blockchain developers.
The malware stole crypto wallet data, SSH keys, GitHub tokens, AWS credentials, browser data, and environment variables.
Rust packages on Crates.io targeted Sui and Move developers by abusing build.rs scripts to exfiltrate wallet keystores.

A massive cross-platform software supply chain attack targeting crypto and AI developers has exposed how malicious packages hidden inside popular open-source ecosystems can silently steal wallets, cloud credentials, and sensitive developer secrets.

Security researchers at Socket uncovered an active malware campaign dubbed “TrapDoor,” which spread across npm, PyPI, and Crates.io using dozens of fake developer tools disguised as security scanners, Solidity helpers, AI utilities, and blockchain development packages.

According to Socket, the operation involved at least 34 malicious packages and hundreds of related versions and artifacts published across the three major software registries.

The malware targeted developers working in crypto, DeFi, Solana, Sui, AI, and cloud infrastructure environments.

The campaign is especially alarming because it combines traditional package-based malware with newer AI-focused attack techniques designed to manipulate developer assistants such as Claude and Cursor.

Top Crypto Tax Accounting Software

TrapDoor Malware Spread Across npm, PyPI, and Crates.io

Researchers said the earliest known TrapDoor package appeared on PyPI on May 22, 2026, under the name “eth-security-auditor.” From there, the malware rapidly expanded across multiple ecosystems through coordinated publishing waves.

The malicious packages used ecosystem-specific execution methods to compromise victims during normal software installation or build processes.

On npm, packages relied on postinstall hooks to automatically execute malware immediately after installation.

Socket researchers identified more than 20 malicious npm packages with names such as “wallet-security-checker,” “defi-threat-scanner,” and “web3-secrets-detector.”

Socket findings — The Gemini CLI discussion was used to promote MCP/security tooling into an AI developer community. | Credit: socket.dev

Once installed, the packages deployed a shared JavaScript payload called “trap-core.js,” a credential-stealing tool spanning more than 1,100 lines of code.

The payload scanned infected systems for:

SSH keys
GitHub credentials
AWS cloud tokens
Browser login databases
Crypto wallet extensions
Environment variables
Local development files
Solana, Sui, and Aptos wallet data

Researchers said the malware also validated stolen AWS and GitHub credentials through live API calls, helping attackers distinguish valuable accounts from expired or invalid ones.

On PyPI, the malware executed remote JavaScript payloads during Python package imports. Instead of embedding the malicious code directly, the packages downloaded JavaScript from attacker-controlled GitHub Pages infrastructure and executed it using Node.js commands.

Meanwhile, the Rust ecosystem was targeted through malicious Crates.io packages aimed specifically at Sui and Move blockchain developers.

These packages abused Rust’s build.rs functionality, which executes automatically during compilation.

The malicious build scripts searched for wallet keystores, encrypted the data using a hardcoded XOR key, and exfiltrated it to GitHub Gists controlled by the attackers.

Attackers Used AI Injection and Persistence Techniques

One of the most unusual aspects of the TrapDoor campaign was its use of AI-targeted injection techniques.

Researchers found that the malware attempted to manipulate AI coding assistants via hidden instructions embedded in files such as “.cursorrules” and “CLAUDE.md.” These files are commonly used to provide project guidance to AI developer tools.

The attackers used zero-width Unicode characters to hide malicious instructions that tricked AI assistants into performing fake “security scans” that exposed sensitive local credentials and environment data.

Socket said the malware also established multiple persistence mechanisms to maintain access after initial infection. Observed persistence methods included git hooks, shell hooks, systemd services, cron jobs, SSH propagation, and AI assistant configuration files,

The npm payload was particularly dangerous because it attempted lateral movement using stolen SSH keys to access additional machines and developer infrastructure.

Researchers also linked the campaign to a GitHub account called “ddjidd564,” which hosted malicious payloads, configuration files, and internal malware documentation via GitHub Pages.

The repository contained files such as “AUDIT-MATRIX.md,” “PAYLOAD.md,” and “BYPASS.md,” describing credential theft workflows, AI-agent abuse, prompt injection tactics, and persistence strategies.

Crypto and AI Developers Were the Primary Targets

Socket researchers said the campaign deliberately targeted high-value developer communities where crypto wallets, cloud credentials, and deployment infrastructure are commonly stored.

The fake packages impersonated developer utilities tied to DeFi tooling, Solidity optimization, AI workflows, environment setup, and blockchain infrastructure.

The attackers also attempted to expand the campaign by submitting GitHub pull requests to several prominent AI and developer projects, including LangChain, OpenHands, MetaGPT, and browser-use.

The pull requests typically proposed adding “.cursorrules” or “CLAUDE.md” files under innocent-looking titles referencing build verification or development standards.

Many of the files contained hidden instructions linked to the same malicious infrastructure used throughout the campaign.

Security researchers warned that the attack demonstrates how modern supply chain threats are evolving beyond simple malware downloads.

Instead of only targeting software dependencies, attackers are increasingly exploiting the entire developer workflow, including AI assistants, cloud environments, shell configurations, Git hooks, browser profiles, and crypto wallets.

Socket said many of the malicious packages have already been removed from public registries, though some remained active at the time of publication.

The firm added that its detection systems identified most TrapDoor releases within minutes of publication, with the fastest detection occurring just 58 seconds after a malicious package went live.

Recommended Secure Partners

TrapDoor Malware Used npm, PyPI, and Rust Packages to Steal Crypto Wallets

TrapDoor Malware Spread Across npm, PyPI, and Crates.io

Attackers Used AI Injection and Persistence Techniques

Crypto and AI Developers Were the Primary Targets

Related