Critical Supply Chain Attack Compromises 34 npm, PyPI, and Crates Packages

Key Takeaways

• A new supply chain attack, dubbed “TrapDoor,” is actively distributing 34 malicious packages across npm, PyPI, and Crates.io.
• The primary goal of the campaign is to steal developer credentials and cryptocurrency wallets, specifically targeting individuals in the crypto, DeFi, Solana, and AI sectors.
• TrapDoor employs ecosystem-specific execution methods and sophisticated obfuscation techniques, including zero-width Unicode characters to manipulate AI coding assistants.
• Security firm Socket detected the malicious packages rapidly, limiting widespread adoption, but the campaign highlights persistent threats to software supply chains.

A significant new supply chain attack, identified as the “TrapDoor” campaign, is currently deploying 34 harmful packages and over 384 associated versions across major package repositories including npm, PyPI, and Crates.io. The sophisticated operation aims to compromise developer credentials and siphon off cryptocurrency holdings.

This malicious campaign specifically targets developers engaged in the cryptocurrency, decentralized finance (DeFi), Solana blockchain, and artificial intelligence (AI) communities. It achieves this by camouflaging its malware as legitimate developer utilities and security auditing tools.

The earliest component of the TrapDoor campaign was observed on May 22, 2026, with the publication of the PyPI package [email protected]. The threat rapidly expanded to other registries, with packages uploaded in distinct waves. Attackers used deceptive names such as prompt-engineering-toolkit, solidity-deploy-guard, and defi-threat-scanner to imbue the packages with a false sense of legitimacy within relevant developer ecosystems.

Security researchers at Socket successfully identified these TrapDoor releases with a median detection time of just 5 minutes and 27 seconds. This swift action allowed the entire campaign to be classified as malicious before it could achieve widespread adoption among developers.

Cross-Ecosystem Attack Vectors

The TrapDoor campaign leverages distinct, ecosystem-specific execution pathways to maximize its impact during typical developer installation and build processes. By customizing the attack vector for each package registry, the threat actor ensures the malicious code executes silently before developers can thoroughly inspect underlying dependencies.

TrapDoor is designed to harvest an extensive array of sensitive developer data. This includes targeting Sui, Solana, and Aptos crypto wallets, as well as SSH keys, browser profiles, and AWS environment variables.

The core npm payload, a 1,149-line JavaScript file named trap-core.js, is engineered to establish long-term access. It achieves complex persistence through various mechanisms, including systemd services, cron jobs, Git hooks, and shell hooks.

Furthermore, any stolen SSH keys are subsequently repurposed to enable automated lateral movement. This tactic effectively transforms individual compromised workstations into persistent access points for broader corporate network breaches.

A distinctive feature of the TrapDoor campaign is its deliberate targeting of AI coding assistants. This is accomplished by modifying .cursorrules and CLAUDE.md project files.

The threat actor employs zero-width Unicode characters to obscure malicious prompts, thereby tricking AI systems into performing hostile credential exfiltration under the guise of executing an automated project security scan, as reported by Socket.

To scale this specific attack vector, the attacker utilized the GitHub account ddjidd564 to submit deceptive pull requests containing these poisoned configuration files to prominent open-source AI projects, including LangChain, MetaGPT, and OpenHands.

The attacker maintains a sophisticated command and control infrastructure hosted on GitHub Pages. This infrastructure hosts active malicious configuration files alongside a detailed AUDIT-MATRIX.md framework design document.

This operational playbook outlines a “Universal AI Agent Extraction Framework” that strategically relies on a disguise layer. This layer maps stealthy credential theft to seemingly benign developer automation workflows.

To maximize the value of exfiltrated data, the payloads actively validate stolen AWS and GitHub tokens via live API queries. They also utilize advanced cryptography across the different ecosystems to evade standard network detection mechanisms.

What You Should Do

• Review Dependencies: Scrutinize all third-party packages and libraries used in your projects, especially those from npm, PyPI, and Crates.io. Verify package authenticity and developer reputation.
• Implement Supply Chain Security Tools: Utilize tools that automatically scan for malicious packages and vulnerable dependencies.
• Monitor Post-Install Scripts: Be cautious of packages that execute extensive scripts during installation (e.g., npm post-install hooks, Rust build.rs scripts) and understand their purpose.
• Segregate Development Environments: Isolate development environments from production systems and sensitive corporate networks to limit lateral movement in case of a compromise.
• Rotate Credentials Regularly: Regularly rotate API keys, SSH keys, and other developer credentials.
• Educate on AI Assistant Security: Be aware of the risks of manipulating AI coding assistants with obscured prompts and ensure secure configurations for these tools.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.