Researchers at Socket Security have identified a sophisticated malware campaign targeting crypto developer environments through multiple programming language registries. According to their report, the TrapDoor campaign spans npm, PyPI, and Crates.io with over 384 total versions across more than 34 malicious packages. The campaign specifically targets environments tied to Aptos, Sui, and Solana ecosystems, using malicious packages that impersonate developer tooling for crypto, DeFi, AI, and security workflows. As per Socket Security, the malware is after secrets like wallets and keys rather than just draining a single wallet, making it a low-volume but high-impact operation that targets teams building in crypto, DeFi, AI and security where a single hacked machine can leak high-value secrets. The operation was first spotted on May 22, 2026, with the earliest package being the PyPI module eth-security-auditor@0.1.0, uploaded on May 22, 2026, at 20:20:18 UTC, and moved rapidly across all three registries throughout the weekend using a small set of accounts to flood the ecosystem.
Each ecosystem receives tailored execution paths designed to maximize effectiveness. npm packages use postinstall hooks with a shared payload called trap-core.js, a 1,149-line credential harvester that scans for secrets, validates stolen AWS and GitHub tokens through live API calls, and maintains persistence through .cursorrules files, CLAUDE.md files, Git hooks, shell hooks, systemd services, cron jobs, and SSH-based lateral movement. Crates.io packages abuse build.rs scripts that run automatically during Rust compilation, locating local keystores and encrypting data using a hardcoded XOR key before shipping to GitHub Gists. PyPI packages auto-execute on import, download JavaScript from attacker-controlled GitHub Pages domains, and run it through node -e, allowing remote payload updates without pushing new versions to PyPI. The attackers also weaponize AI coding tools by planting hidden instructions inside .cursorrules and CLAUDE.md files using zero-width Unicode characters, attempting to trick AI assistants into running data exfiltration routines disguised as security scans. The packages programmed in JavaScript, Python and Rust were disguised as developer helpers, security scanners, wallet tools, Solidity utilities, AI prompt packages and Sui or Move build helpers.
According to Socket Security, the campaign identified 21 npm packages, 7 PyPI packages, and 6 Crates.io packages linked to TrapDoor. npm packages included tools such as token-usage-tracker, wallet-security-checker, defi-risk-scanner, prompt-engineering-toolkit, and llm-context-compressor, designed to blend into developer dependency lists without raising suspicion. Crates.io packages focused on Sui and Move development tooling, including sui-move-build-helper and move-compiler-tools. PyPI packages included cryptowallet-safety and defi-risk-scanner. The package names were crafted to resemble development tooling across crypto, DeFi, AI, and security workflows, specifically targeting environments where many Web3 and infrastructure engineers reuse keys across projects and services, meaning one successful infection might provide attackers wide access to private repos, production servers and treasury systems. The attacker's GitHub account, ddjidd564, opened pull requests on several high-profile AI and developer projects including browser-use/browser-use, langchain-ai/langchain, langflow-ai/langflow, run-llama/llama_index, FoundationAgents/MetaGPT, and OpenHands/OpenHands.
The attackers built an entire ecosystem around their malware, creating lure repositories to attract developer attention and planting issues and discussions promoting fake "security" workflows in legitimate developer communities. According to Socket Security, the attacker maintained a Universal AI Agent Extraction Framework documented in an AUDIT-MATRIX.md file that describes the operation as a "Universal AI Agent Extraction Framework" with staged workflows for capability detection, data extraction, self-replication, and telemetry reporting. The "disguise layer" section maps credential theft actions to benign-sounding tasks like security audits, wallet safety checks, and cloud configuration validation. The campaign also attempted to get malicious configuration merged into popular open source projects where AI tools would read and follow embedded instructions, with GitHub flagging at least one PR for containing hidden or bidirectional Unicode text. This represents a new front in supply chain attacks where developers must now deal with the possibility that their AI assistants could be turned against them.
According to Socket Security, the company's automatic analysis swiftly identified the malware releases, with the system flagging harmful packages within a median of 5 minutes, 27 seconds from when a release goes live. In the fastest scenario, Socket Security was able to identify a TrapDoor contaminated package within 58 seconds of publication, greatly shrinking the window of opportunity for attackers to infect users at scale. The malware's ability to impersonate legitimate developer tools across multiple platforms makes it particularly dangerous for the crypto and blockchain development community, as it can easily bypass standard security checks and access sensitive information stored on developer machines. Socket Security has reported all identified packages to the affected registries and is tracking the campaign on a dedicated page, advising that anyone working in crypto, DeFi, Solana, Sui, Move, or AI development should check their dependencies immediately against the full list of malicious packages, treating any compromised systems as full compromise requiring immediate rotation of all credentials, SSH keys, API keys, and wallet keys.
