A new malware campaign called TrapDoor is targeting crypto and AI developers through fake developer tools spread across npm, PyPI, and Rust package ecosystems.
Quick Summary – TLDR:
- TrapDoor malware has infected more than 34 malicious packages and over 380 related versions across npm, PyPI, and Crates.io.
- Attackers are stealing crypto wallet data, SSH keys, cloud credentials, API keys, and GitHub tokens.
- The malware also attempts to manipulate AI coding assistants like Claude and Cursor using hidden prompts.
- Researchers say the campaign specifically targets developers working in crypto, DeFi, AI, and blockchain infrastructure.
What Happened?
Security researchers at Socket uncovered a coordinated malware campaign called TrapDoor that spreads through fake open source developer packages. The malware has already appeared across npm, PyPI, and Rust’s Crates.io repositories, making it one of the broadest cross-ecosystem supply chain attacks seen recently.
The campaign mainly targets developers building crypto, AI, and decentralized finance applications. Researchers say the malware disguises itself as legitimate developer utilities and setup tools to trick users into installing infected packages during normal development work.
🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.io.
— Socket (@SocketSecurity) May 24, 2026
Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems.
TrapDoor targets… pic.twitter.com/0CI758NJ6T
Fake Developer Tools Used to Spread Malware
According to Socket researchers, the attackers created packages that looked like common development helpers. Some of the fake package names included tools for wallet security, Solidity deployment, AI prompt engineering, and blockchain development.
The malicious packages were designed to blend into normal workflows so developers would not suspect anything unusual. Once installed, the malware quietly searched systems for sensitive information.
Researchers said TrapDoor specifically targets:
- SSH keys
- AWS credentials
- GitHub tokens
- Browser login data
- Environment variables
- Crypto wallet information
- API keys
- Cloud configuration files
The malware reportedly targeted wallets and platforms connected to Coinbase, Binance, MetaMask, Solana, Sui and Aptos.
AI Coding Assistants Became a New Attack Vector
One of the most unusual parts of the TrapDoor campaign is its attempt to abuse AI coding tools.
Socket CTO Ahmad Nassri said the malware injects hidden instructions into files like .cursorrules and CLAUDE.md. These files are commonly used by AI coding assistants such as Claude and Cursor to understand project instructions.
Researchers said the attackers tried to push AI assistants into running fake “security scans” that would expose sensitive developer secrets and transmit them back to attackers.
The report noted that attackers used hidden Unicode characters and AI themed documentation to disguise malicious instructions inside developer environments.
Malware Used Different Tricks Across Ecosystems
TrapDoor adapted its behavior depending on which ecosystem it targeted.
In npm packages, the malware used postinstall scripts to automatically execute malicious code after installation. The payload known as trap-core.js reportedly scanned systems for credentials and even attempted SSH-based lateral movement.
In Rust packages on Crates.io, attackers abused build.rs scripts that automatically run during compilation. These scripts searched for local crypto wallet keystores and sent stolen data to GitHub Gists after encrypting it.
Meanwhile, PyPI packages executed remote JavaScript payloads immediately after import. Researchers said this allowed attackers to change malware behavior remotely without uploading a new package version.
GitHub Activity Raised More Concerns
Researchers also connected the campaign to suspicious GitHub activity. The attackers allegedly opened pull requests on several AI and developer projects while attempting to insert files linked to the malware campaign.
Socket said the repositories showed signs of rapid AI assisted development with partially completed malware components, fake security documentation, and lure repositories designed to appear legitimate.
The report also mentioned that GitHub recently disclosed unauthorized access to internal repositories after an employee device was compromised.
Supply Chain Attacks Continue to Grow
The TrapDoor operation highlights how attackers are increasingly targeting software supply chains and developer environments instead of individual users.
Security researchers warned that developers often install third party packages with elevated permissions without fully reviewing the code, making open source ecosystems attractive targets for attackers.
The campaign also shows how AI development tools are quickly becoming part of the modern attack surface as hackers experiment with new ways to abuse automated coding workflows.
SQ Magazine Takeaway
I think TrapDoor is one of the clearest signs that developers are now becoming the primary target instead of just the end users. Attackers know that one compromised developer machine can unlock wallets, cloud systems, GitHub repositories, and even AI workflows at the same time. What makes this even more worrying is how normal these fake packages looked. Most developers install tools quickly during projects, and that habit is now turning into a major security risk.
The AI assistant angle is what really stands out here. Hackers are no longer just writing malware for operating systems. They are actively trying to manipulate AI coding tools and automated workflows. That changes the security conversation completely.
