Solana, Sui and Aptos wallet data targeted in TrapDoor package attack
TrapDoor planted 34+ fake packages across npm, PyPI and Crates.io to steal wallet data, SSH keys and cloud credentials from developers.
Intelligence analysis by GPT-5.4 Mini
TrapDoor is a supply-chain campaign aimed at crypto, DeFi, AI and security developers. Fake tools across npm, PyPI and Crates.io were built to steal wallet files, SSH keys, cloud logins, GitHub tokens and browser data, while also seeding hidden instructions for AI coding tools.
A group slipped fake helper tools into places where programmers download code. The tools looked boring and useful, but they were made to grab secret things like wallet files and login keys.
It was a bit like hiding a thief inside a toolbox. The toolbox looks normal on the shelf, but once it is opened, the thief can look through the room and take what is valuable.
The scary part is that the attack was aimed at people who build crypto software and other important systems. No stolen money was named in the story, but the plan was clearly built to find secrets on developers’ computers.
Analysis
What happened
Security firm Socket says it found a supply-chain campaign called TrapDoor spread across npm, PyPI and Crates.io. The operation used more than 34 malicious packages and hundreds of related versions and artifacts, all disguised as ordinary developer utilities.
The packages were aimed at crypto, DeFi, AI and security developers. Names such as wallet-security-checker, defi-risk-scanner, solidity-build-guard, move-compiler-tools and llm-context-compressor were designed to look harmless enough that a busy developer might install them without a second thought.
What the payload tried to do
Once installed, the packages tried to search developer machines for private keys, passwords, GitHub tokens, wallet files, browser data and cloud credentials. Socket said some payloads also tested stolen credentials, attempted lateral movement through SSH keys, and left files behind to keep access alive.
The campaign used different delivery methods depending on the ecosystem. Rust packages used malicious build.rs scripts during compilation, PyPI packages ran remote JavaScript on import, and npm packages used postinstall hooks.
Why this is more than a normal package scam
Socket said the attackers also targeted AI coding workflows. They hid instructions in files such as .cursorrules and CLAUDE.md, using zero-width Unicode characters to try to make future AI assistant sessions run fake security scans that would collect and exfiltrate secrets.
That makes the campaign broader than a simple credential stealer. The article frames it as an attempt to compromise the workstation itself: wallets, repositories, browser data, cloud keys, SSH access and the next AI tool that reads the project files. Socket said it reported the packages to the affected registries and classified them as malicious, but it did not identify victims or stolen funds.
Key points
- TrapDoor spread through more than 34 malicious packages on npm, PyPI and Crates.io.
- The fake tools targeted crypto, DeFi, AI and security developers.
- The payloads sought wallet files, SSH keys, GitHub tokens, AWS credentials and browser data.
- Researchers said hidden instructions were planted for AI coding tools using files like `.cursorrules` and `CLAUDE.md`.
- Socket reported the packages to the registries and called the campaign malicious.
