Malicious Packages Steal Cloud Keys, Wallets, and SSH Credentials
Key Takeaways A sophisticated supply chain attack, dubbed “TrapDoor,” infiltrated three major open-source ecosystems: npm, PyPI, and Crates.io. Threat actors deployed 34 malicious...
Key Takeaways
- A sophisticated supply chain attack, dubbed “TrapDoor,” infiltrated three major open-source ecosystems: npm, PyPI, and Crates.io.
- Threat actors deployed 34 malicious packages with 384 total versions to steal sensitive data, including cloud credentials, SSH keys, and blockchain wallet information from developers.
- The attack leveraged built-in ecosystem mechanisms for automatic execution upon package import, compilation, or installation, with some variants also hijacking AI coding assistants and Git hooks for persistent infection.
- Exfiltration infrastructure relied on trusted services like GitHub Pages and webhook.site to evade detection by blending with legitimate network traffic.
- Immediate action is required from developers to identify and remove compromised packages, rotate credentials, and implement enhanced detection rules.
A widespread supply chain campaign, identified as “TrapDoor,” has successfully compromised three prominent open-source package repositories: npm, PyPI, and Crates.io. This operation saw the deployment of 34 malicious packages, across 384 distinct versions, meticulously designed to pilfer critical developer data, including cloud credentials, SSH private keys, and cryptocurrency wallet information.
Table Of Content
The campaign, initially unveiled by the security research team at Socket.dev on May 24, 2026, targeted developers working in high-value sectors such as cryptocurrency, decentralized finance (DeFi), Solana, artificial intelligence (AI), and security research. The malicious code activated automatically upon the simple act of installing or building a package, requiring no further interaction from the unsuspecting victim.
Advanced Evasion and Execution
What made TrapDoor particularly insidious was its seamless integration into standard developer workflows. The attackers exploited the inherent mechanisms of each ecosystem to trigger their malicious logic without raising immediate alarms.
- PyPI: Malicious code executed instantly upon package import.
- Crates.io: The payload was triggered during the compilation phase of a project.
- npm: The threat actors configured the code to run silently in the background immediately after installation, bypassing typical security alerts.
Analysts at SlowMist, leveraging their MistEye threat intelligence system, conducted an in-depth technical analysis of the campaign, confirming malicious activity across all three platforms. Their findings were detailed in a report shared with Cyber Security News (CSN).
Unified Attack Strategy
SlowMist’s investigation focused on three representative samples: git-config-sync from PyPI, token-usage-tracker from npm, and sui-framework-helpers from Crates.io. The analysis revealed a consistent underlying strategy: design the attack once and adapt it for deployment across multiple ecosystems.
The breadth of stolen information was extensive, encompassing AWS keys, GitHub tokens, OpenAI API keys, SSH private keys, various blockchain wallet files, browser login databases, and environment variables that could contain sensitive passwords or secrets. The npm sample exhibited additional capabilities, attempting to brute-force weak passwords on Ethereum keystore files and execute arbitrary remote commands on compromised systems. This comprehensive data theft could grant attackers access to both personal developer accounts and the cloud infrastructure they manage.
To further bolster its stealth, TrapDoor’s command-and-control (C2) infrastructure was engineered to avoid detection. Instead of using suspicious, unfamiliar domains, the threat actors routed exfiltrated data through legitimate and commonly trusted services like GitHub Pages, GitHub Gist, and webhook.site. This tactic allowed the stolen credentials to blend seamlessly with normal network traffic, making it exceedingly difficult for traditional security tools to flag the activity as malicious.
Anatomy of the Attack Chain
The TrapDoor campaign consistently followed a three-stage pattern across all targeted ecosystems: trigger, collect, and exfiltrate. Each malicious package was meticulously disguised as a benign, legitimate developer utility.
PyPI & Crates.io Samples
The Python package, git-config-sync, initiated a malicious thread within seconds of being loaded. It employed a random delay to evade suspicion while systematically scanning critical directories such as .ssh, .aws, and .ethereum. Six distinct pattern-matching groups were configured to identify and capture private keys, mnemonic phrases, API tokens, and passwords.
The Rust package, sui-framework-helpers, activated during the compilation process. Its primary targets were wallet files associated with Sui, Aptos, and Solana. Once collected, the stolen data was encoded using an XOR cipher and then uploaded to a public GitHub Gist.
npm Sample: Sophisticated Propagation
The npm package, token-usage-tracker, proved to be the most advanced of the three. After installation, it forked a hidden background process to sweep browser credentials, cloud keys, and wallet data from a wide array of file paths.
Beyond credential theft, the token-usage-tracker included a sophisticated propagation module. It manipulated .cursorrules and CLAUDE.md files within the victim’s project directories. This allowed the attackers to inject instructions that would compel AI coding assistants, such as Cursor and Claude Code, to execute malicious actions during subsequent coding sessions. Crucially, these instructions often utilized zero-width characters, which are invisible to the human eye but fully interpretable and executable by AI models.
Furthermore, the package injected malicious commands into Git hooks, ensuring that every git pull or branch switch silently downloaded fresh malicious code. Shell configuration files like .bashrc and .zshrc were also modified to execute another attacker-controlled package, dev-env-bootstrapper, on an hourly basis, establishing persistence and continuous re-infection.
What You Should Do
- Remove Malicious Packages: Immediately identify and uninstall any of the 34 malicious packages, especially
git-config-sync,token-usage-tracker,sui-framework-helpers, ordev-env-bootstrapper. - Rotate Credentials: Assume all cloud keys (AWS, OpenAI), GitHub tokens, SSH private keys, and blockchain wallet passwords/seed phrases are compromised. Rotate them immediately.
- Clean Configuration Files: Scrutinize and clean
.cursorrules,CLAUDE.md, Git hooks,.bashrc, and.zshrcfiles for any references toP-2024-001,ddjidd564, ordev-env-bootstrapper. - Enhance CI/CD Detection: Update CI/CD pipelines with detection rules that incorporate TrapDoor-related indicators of compromise (IoCs) to prevent future infections.
- Implement Supply Chain Security: Adopt robust software supply chain security practices, including package scanning, integrity checks, and least privilege principles for developer environments.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Domain | ddjidd564[.]github[.]io | Attacker-controlled GitHub Pages domain used for remote configuration distribution |
| URL | https[:]//ddjidd564[.]github[.]io/defi-security-best-practices/config.json | Remote configuration endpoint shared by Python and npm samples for webhook retrieval |
| URL | https[:]//raw[.]githubusercontent[.]com/ddjidd564/defi-security-best-practices/main/config.json | Raw GitHub mirror of the attacker’s configuration file |
| URL | https[:]//ddjidd564[.]github[.]io/defi-security-best-practices/priority_targets.json | Priority target configuration file used by the npm sample |
| URL | https[:]//raw[.]githubusercontent[.]com/ddjidd564/defi-security-best-practices/gh-pages/scan-bundled.js | Malicious propagation script injected via Git hooks |
| URL | https[:]//raw[.]githubusercontent[.]com/ddjidd564/defi-security-best-practices/gh-pages/scan.js | Secondary malicious script hosted on attacker-controlled GitHub repository |
| URL | https[:]//webhook[.]site/2ada14c8-00f6-43ce-9ad6-f5dc15952246 | Webhook exfiltration receiver endpoint (fallback channel) |
| URL | https[:]//webhook[.]site/7513bf3d-7092-4739-bf15-a8f779a75546 | Webhook exfiltration receiver endpoint (fallback channel) |
| URL | https[:]//webhook[.]site/d1652693-2eb8-4281-b9e8-cffff36da2f8 | Webhook exfiltration receiver endpoint (fallback channel) |
| File Name | git-config-sync | Malicious PyPI package disguised as a Git configuration sync tool |
| File Name | token-usage-tracker | Malicious npm package disguised as an AI token usage tracker |
| File Name | sui-framework-helpers | Malicious Crates.io package disguised as a Sui Move development helper |
| File Name | dev-env-bootstrapper | Secondary malicious npm package used for hourly persistent re-infection |
| File Path | /tmp/.cargo_build_log_<pid>.hex | Temporary on-disk copy of XOR-encoded stolen wallet data (Rust sample) |
| File Path | ~/.local/share/.p2024_integrity | Marker file used by npm sample to prevent repeated infection within 24 hours |
| Attack Marker | P-2024-001 | Unified attack marker string used across npm payloads, shell RC functions, and AI context files |
| Encryption Key | cargo-build-helper-2026 | Fixed XOR key used by the Rust sample to obfuscate exfiltrated wallet data |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.
No Comment! Be the first one.