TrapDoor Supply-Chain Campaign Targets npm, PyPI and Crates.io With Crypto Stealer
Summary
Socket researchers identified TrapDoor, a cross-registry campaign involving more than 34 malicious packages and 384+ versions and artifacts that steal developer credentials, crypto wallet data and other secrets.
Key points
- Malicious packages across npm, PyPI and Crates.io masquerade as developer tools and execute during installation, import or Rust builds.
- The malware targets SSH keys, crypto wallet data, AWS and GitHub credentials, browser data, environment variables and API keys.
- The npm payload scans for and validates credentials, attempts SSH-based lateral movement, and establishes persistence through hooks, system services, cron and AI-assistant project files.
- Crates.io build scripts search for local keystores, encrypt them with a hardcoded XOR key and exfiltrate them to GitHub Gists; PyPI packages download and run remote JavaScript on import.
- The campaign also plants hidden instructions in files such as .cursorrules and CLAUDE.md and used GitHub pull requests to try to introduce campaign-linked files into developer projects.
- Socket says it reported identified packages to the registries; some packages had been removed, while others were still live at the time of its analysis.
Article Details
- Attack Vectors
- Malicious packages masquerade as developer helpers and security auditing utilities across npm, PyPI, and Crates.io.
- npm postinstall hooks execute trap-core.js to harvest developer credentials and establish persistence.
- PyPI packages download attacker-hosted JavaScript on import and execute it using node -e.
- Crates.io packages execute malicious build.rs scripts during compilation to locate wallet keystores, XOR-encrypt their contents, and exfiltrate them to GitHub Gists.
- Hidden instructions containing zero-width Unicode characters in .cursorrules and CLAUDE.md attempt to induce AI coding assistants to discover and exfiltrate secrets; effectiveness across tools and models is uncertain.
- Attacker-created pull requests attempt to introduce campaign-linked AI instruction files into open source projects under development-guidance and build-verification pretexts.
- The npm payload attempts SSH-based lateral movement using stolen keys and persistence through Git hooks, shell hooks, systemd services, and cron jobs.
- Defensive Notes
- Socket classified all identified packages as malicious, reported them to the affected registries, and stated that it was continuing to monitor related packages and infrastructure.
- Some malicious packages had been removed, while others remained live at the time of writing.
- Socket connected activity across registries using shared infrastructure, payload markers, and behavioral overlap rather than treating each package as an isolated incident.
- GitHub warned that a proposed .cursorrules file contained hidden or bidirectional Unicode text that could be interpreted differently from its browser presentation.
- The attacker-authored AUDIT-MATRIX.md is a partially implemented design document, not evidence that every described extraction capability was deployed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ddjidd564[.]github[.]io | Attacker-controlled GitHub Pages domain hosting remote payloads and configuration for the malicious packages. |
| URL | hxxps[:]//ddjidd564[.]github[.]io/defi-security-best-practices/config[.]json | Attacker-controlled configuration URL embedded in a proposed malicious .cursorrules file. |
MITRE ATT&CK
T1005 · Data from Local SystemThe packages collect local wallet data, keystores, browser profiles, and development configuration files.T1021.004 · SSHThe npm payload attempts to access additional systems over SSH using stolen keys.T1053.003 · CronThe npm payload uses cron jobs as an observed persistence mechanism.T1059.007 · JavaScriptPyPI packages download remote JavaScript and execute it using node -e; npm packages execute the shared trap-core.js payload.T1105 · Ingress Tool TransferPyPI packages download JavaScript payloads from attacker-controlled GitHub Pages infrastructure.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious dependencies published across npm, PyPI, and Crates.io execute during installation, import, or compilation.T1543.002 · Systemd ServiceThe npm payload establishes persistence through systemd services.T1546.004 · Unix Shell Configuration ModificationThe npm payload uses shell hooks to preserve execution in developer environments.T1552.001 · Credentials In FilesThe payload scans local development configuration and credential files for AWS credentials, GitHub tokens, API keys, and other secrets.T1552.004 · Private KeysThe malicious packages collect SSH keys, and the npm payload attempts to reuse stolen keys for propagation.T1555.003 · Credentials from Web BrowsersThe malicious packages target browser login databases and browser credential data.T1567.001 · Exfiltration to Code RepositoryMalicious Rust build scripts exfiltrate encrypted wallet keystore data to GitHub Gists.
Threat Actors
asdxzxcnpm publisher account identified by Socket as publishing malicious packages that execute the shared trap-core.js payload.ddjidd564Attacker GitHub account identified by Socket as hosting payloads and configuration, creating lure repositories, and opening pull requests containing campaign-linked AI instruction files.
Malware
Vendors
Amazon Web ServicesSeveral npm packages also deploy a shared payload, trap-core.js, that scans for credentials, validates AWS and GitHub tokens, attempts SSH-based lateral movement, and plants persistence through .cursorrules,GitHubnpm packages also deploy a shared payload, trap-core.js, that scans for credentials, validates AWS and GitHub tokens, attempts SSH-based lateral movement, and plants persistence through .cursorrules, CLAUDE.md, Git
Products
crates.ioSocket researchers have identified an active crypto stealer supply chain attack spanning npm, PyPI, and Crates.io. The campaign, which Socket is tracking as TrapDoor, spans more than 34 malicious packages and 384+npmSocket researchers have identified an active crypto stealer supply chain attack spanning npm, PyPI, and Crates.io. The campaign, which Socket is tracking as TrapDoor, spans more than 34 malicious packages and 384+PyPISocket researchers have identified an active crypto stealer supply chain attack spanning npm, PyPI, and Crates.io. The campaign, which Socket is tracking as TrapDoor, spans more than 34 malicious packages and 384+
Industries
AITrapDoor targets developers in crypto, DeFi, Solana, and AI communities. The malicious packages are designed to steal developer secrets, crypto wallets, SSH keys, cloud credentials, browser data, and environmentcryptoSocket researchers have identified an active crypto stealer supply chain attack spanning npm, PyPI, and Crates.io. The campaign, which Socket is tracking as TrapDoor, spans more than 34 malicious packages and 384+DeFiTrapDoor targets developers in crypto, DeFi, Solana, and AI communities. The malicious packages are designed to steal developer secrets, crypto wallets, SSH keys, cloud credentials, browser data, and environment