TrapDoor Supply Chain Attack Targets Crypto and AI Developers

A coordinated software supply chain attack campaign dubbed "TrapDoor" has targeted developers in the cryptocurrency, decentralized finance (DeFi), and artificial intelligence sectors [1]. Security researchers at Socket identified that the campaign, which began on May 22, 2026, utilized more than 34 malicious packages across 384 versions to exfiltrate sensitive data from developer environments [2].

Key takeaways

• The campaign targets npm, PyPI, and Crates.io to distribute malware designed to steal crypto wallets, SSH keys, and cloud credentials [1].
• Malicious packages masquerade as legitimate development tools for ecosystems including Solana, Sui, and Aptos [2].
• Attackers are embedding hidden instructions in AI configuration files to trick AI coding assistants into performing unauthorized security scans [1].
• The malware establishes persistence on infected systems through cron jobs, systemd services, and Git hooks [2].

Sophisticated Execution Across Ecosystems

The TrapDoor campaign employs ecosystem-specific methods to compromise developer machines [1]. On npm, malicious packages use post-install hooks to deploy a JavaScript payload known as "trap-core.js," which scans for credentials and validates them against AWS and GitHub services [2]. Python packages on PyPI are designed to execute remote JavaScript payloads upon import, allowing attackers to update their malicious behavior dynamically without needing to republish the package [1]. Meanwhile, Rust crates on Crates.io utilize "build.rs" scripts that activate during compilation to search for local keystores, specifically targeting data related to Sui and Move development [2].

The stolen data includes information from cryptocurrency wallets—specifically those associated with Solana, Sui, Aptos, Coinbase, Binance, and MetaMask—as well as browser profiles and environment variables [2]. Beyond simple data theft, the malware attempts lateral movement across networks by leveraging compromised SSH keys [2]. The attackers have also been observed submitting pull requests to popular open-source projects, such as LangChain, to propagate malicious configurations [2].

AI Manipulation and Future Risks

A notable feature of the TrapDoor campaign is the use of hidden instructions within files like ".cursorrules" and "CLAUDE.md" [1]. By using techniques such as zero-width Unicode characters, attackers attempt to manipulate AI coding assistants into executing "security scans" that actually result in the discovery and exfiltration of secrets [2]. Socket researchers suggest that the threat actors are testing whether these hidden instructions can be introduced into open-source workflows to exploit the way AI tools parse project files [1].