Security researchers have uncovered a sophisticated supply chain attack targeting cryptocurrency and AI developers through fake developer tools. According to a report published by developer security platform Socket, the TrapDoor campaign has already spread through at least 34 malicious packages and 384 connected versions across multiple software ecosystems. The attack was first identified on May 22, 2026, at 8:20 p.m. UTC, with new packages published to the ecosystems in waves from a cluster of accounts in quick succession. The campaign targets developers working in cryptocurrency, decentralized finance, artificial intelligence, and security infrastructure sectors, with the malicious packages designed to steal developer secrets, crypto wallets, SSH keys, cloud credentials, browser data, and environment variables.
The malware campaign specifically targets wallets and platforms linked to major cryptocurrency exchanges and blockchain ecosystems. According to Socket, the targeted services include wallets and platforms linked to Coinbase, Binance, MetaMask, Phantom, along with blockchain ecosystems tied to Solana, Sui, and Aptos. The attackers have focused on developers working in sectors where exposed credentials can provide access to wallets, repositories, cloud environments, and internal systems. The infected packages were disguised as common development utilities including project setup tools, model-routing software, Solidity frameworks, and build helpers for Sui and Move-based applications. As reported by Cointelegraph, the primary targets include cryptocurrency wallet extensions such as MetaMask and Phantom, as well as SSH keys and GitHub authentication tokens, with the theft of MetaMask or Phantom wallet keys potentially resulting in the loss of cryptocurrency holdings. According to Socket's CTO Ahmad Nassri, the malware also targets the Brave internet browser, expanding the scope of affected platforms.
According to Socket's report, the malware attempts to manipulate AI coding assistants such as Claude and Cursor by injecting hidden prompts into development workflows. The attackers appear to be pushing AI tools into running fake security scans that expose secrets and transmit them back to operators. Socket's CTO Ahmad Nassri noted that the malware also injects hidden instructions to "hijack your AI coding assistant," targeting Claude and Cursor. "The goal appears to be to trick AI assistants into running a 'security scan' or similar workflow that causes secret discovery and exfiltration," Socket said. GitHub repositories linked to the operation showed signs of AI-assisted development activity, including rapidly generated lure repositories and partially completed malware components. To scale this specific attack vector, the attacker used the GitHub account ddjidd564 to submit deceptive pull requests containing poisoned configuration files to prominent open-source AI projects like LangChain, MetaGPT, and OpenHands. The threat actor is likely testing whether AI-related project files can be introduced through regular open-source contribution workflows, thereby causing AI coding tools to parse those hidden instructions and apply them.
The TrapDoor campaign utilizes distinct, ecosystem-specific execution paths to maximize its reach during standard developer installation and build workflows. According to Socket's analysis, the campaign's earliest observed component was the PyPI package eth-security-auditor@0.1.0, published on May 22, 2026, before expanding rapidly into other repositories. Packages were uploaded in distinct waves across all three registries, utilizing deceptive names like prompt-engineering-toolkit to heavily feign legitimacy within adjacent developer communities. Socket detected these TrapDoor releases with a median detection time of 5 minutes and 27 seconds, effectively classifying the entire campaign as malicious before widespread adoption could occur. The npm packages have been found to run a JavaScript payload (trap-core.js), which scans for credentials and developer secrets, validates stolen credentials using AWS and GitHub API calls, and creates persistence on the host using cron jobs, systemd services, Git hooks, and shell hooks. The Rust crates search for local keystores, encrypt the data using a hardcoded XOR key, and exfiltrate it to GitHub Gists. The Python packages are designed such that they are auto-executed on import, downloading JavaScript from an attacker-controlled GitHub Pages domain and running it using "node -e."
The TrapDoor campaign represents part of a growing pattern of attacks targeting crypto developers through trusted workplace tools and professional communication channels. This follows similar operations including last month's PHANTOMPULSE campaign that used the Obsidian note-taking app to infect cryptocurrency professionals. Earlier in April, blockchain security firm CertiK warned that North Korea-linked Lazarus Group operators had used fake Zoom meetings and compromised Telegram accounts to deliver malware to crypto executives. Security researchers have increasingly warned that software supply chains, collaboration apps, AI development tools, and open-source repositories are becoming common entry points for crypto-focused intrusions due to developers routinely installing third-party packages with elevated system permissions. According to Socket, this attack highlights a growing trend in software supply chain threats, with malicious packages targeting developers becoming more sophisticated. The company advises developers to exercise caution when adding new dependencies, verify package sources, use lock files, run security scans on dependencies, enable multi-factor authentication on GitHub accounts, and store cryptocurrency keys in hardware wallets.
