TrapDoor malware campaign targets crypto and AI developers across npm, PyPI, Crates
Security firm Socket discovered TrapDoor, a coordinated malware campaign injecting hidden instructions into packages across npm, PyPI, and Crates.io to steal cryptocurrency wallet credentials, SSH keys, and cloud credentials from developers, while hijacking AI coding assistants like Claude and Cursor to exfiltrate secrets.
What happened
Security firm Socket discovered a malware campaign called TrapDoor on May 24, 2026, spanning npm, PyPI, and Crates.io registries. The campaign deployed more than 34 malicious packages and 384 related versions, with attackers repeatedly pushing new releases across ecosystems.
The malware targets crypto, decentralized finance, AI, and security developers and is designed to steal wallet data, SSH keys, cloud credentials, GitHub tokens, browser extension data and API keys. It injects hidden instructions with invisible characters to hijack popular AI coding assistants Claude and Cursor, tricking them into running security scans that cause secret discovery and exfiltration.
The malicious package names are crafted to look like development helpers, project setup tools, model routing utilities, prompt engineering packages, Solidity tooling, and Sui or Move build helpers. The malware targets crypto wallets including Coinbase, Binance, Solana, Sui, Aptos, and MetaMask in addition to the Brave internet browser.
Reported impact
Developers working with crypto, DeFi, and AI tools are targeted for credential and wallet theft. The campaign represents the first documented supply chain attack to simultaneously compromise npm, PyPI, and Crates.io registries.
Index analysis
Socket detected a median of 5 minutes and 27 seconds between package release and detection. On npm, the malware uses postinstall hooks to trigger trap-core.js upon download; on PyPI, it executes when the package is imported; on Crates.io, it exploits the build.rs file during compilation.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.