TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO
A cross-ecosystem supply chain campaign used malicious npm, PyPI, and Rust packages to steal developer secrets and persistence data.
Intelligence analysis by GPT-5.4 Mini
Socket says TrapDoor spans 34+ malicious packages across npm, PyPI, and Crates.io, targeting developers with credential theft and host persistence. The campaign also tried to seed hidden instructions into AI-focused project files.
A bad actor slipped fake software tools into places developers trust, like npm, PyPI, and Rust package sites. Those fake tools were really tiny spies looking for passwords, wallet keys, and cloud logins.
Some of the spies also tried to stick around on the computer, like a sticky note that keeps coming back after being torn off. That makes it easier for the attacker to come back later.
The trick was a bit like hiding a trap in a toy box and also sneaking secret notes into a classroom workbook. The article says the attackers even tried to fool AI helper tools by planting hidden instructions in project files.
Analysis
What happened
Socket says a coordinated campaign, codenamed TrapDoor, pushed malicious packages into npm, PyPI, and Crates.io in waves starting May 22, 2026. The operation spans more than 34 packages and over 384 versions, with names crafted to look like developer tooling for crypto, AI, security, and setup tasks.
How it worked
The package behavior varied by ecosystem. In npm, packages ran a shared JavaScript payload called trap-core.js through postinstall hooks and package imports. That payload scanned for developer secrets, cloud credentials, SSH keys, browser data, and environment variables. Socket says it also validated stolen AWS and GitHub tokens, tried SSH-based lateral movement, and created persistence through .cursorrules, CLAUDE.md, Git hooks, shell hooks, systemd, cron, and SSH.
The Rust crates used build.rs to trigger malicious code during builds. Socket says they searched for local keystores, encrypted data with a hardcoded XOR key, and exfiltrated the results to GitHub Gists. The PyPI packages were designed to execute on import and download JavaScript from an attacker-controlled GitHub Pages domain, then run it with node -e, which let the attacker update behavior without publishing a new Python release.
Why it stands out
One unusual element is the use of hidden instructions inside AI-related files such as .cursorrules and CLAUDE.md. Socket says the actor also opened pull requests against projects including browser-use, langchain, and langflow, apparently testing whether AI coding tools would ingest those instructions and run a fake security scan that exposes secrets. The article also notes this TrapDoor campaign is unrelated to a separate ad-fraud operation with the same name.
Key points
- TrapDoor is a cross-ecosystem supply chain campaign hitting npm, PyPI, and Crates.io.
- The malicious packages target developer secrets, crypto wallets, SSH keys, cloud credentials, and browser data.
- npm packages used a shared payload called trap-core.js to steal data and create persistence.
- Rust crates used build.rs to trigger execution and exfiltrated data to GitHub Gists.
- The campaign also tried to plant hidden instructions in AI-related project files and pull requests.
