TrapDoor Crypto Stealer Hits npm, PyPI, and Crates.io

Steady attention without excessive speculation.

Socket’s Threat Research team disclosed the findings on May 24, 2026. The team detected 384+ malicious versions and artifacts across all three registries.

How the TrapDoor Supply Chain Attack Works

Socket reported a median detection time of 5 minutes and 27 seconds. The fastest detection took just 58 seconds from package publication to malware flag. The earliest package appeared on May 22, and the attacker then published new releases rapidly over the following 48 hours.

TrapDoor uses ecosystem-specific hooks to trigger its payload. On npm, 22 packages run postinstall scripts that execute a 1,149-line JavaScript file called trap-core.js. PyPI, seven packages auto-execute malicious code on import and then fetch remote JavaScript payloads. On Crates.io, six packages run malicious build.rs scripts during Rust compilation.

All variants target the same data: Sui, Solana, and Aptos wallets, SSH keys, AWS credentials, GitHub tokens, browser data, and environment variables. The malware encrypts stolen data using Fernet, ECDH, or XOR before sending it to attacker-controlled infrastructure.

According to Socket’s research report, the connection between the three campaigns “became clear during the Crates.io wave, when Rust packages targeting Sui and Move developers showed infrastructure and behavioral overlap with related npm and PyPI packages.”

Persistence and AI-Targeted Backdoors

Beyond data theft, TrapDoor installs multiple persistence mechanisms. These include Git hooks, shell hooks, cron jobs, systemd services, and SSH propagation to other machines the developer can access.

One novel technique plants hidden zero-width Unicode instructions inside .cursorrules and CLAUDE.md files. These files configure AI coding assistants. Once compromised, the AI assistant could unknowingly propagate malicious code into future projects.

This approach exploits the growing adoption of AI-assisted development tools. Developers who rely on AI assistants could spread the infection through generated code without realizing their environment carries hidden instructions.

Targeted Package Names and Attacker Infrastructure

The malicious packages use realistic names designed to attract crypto and security developers. Examples include token-usage-tracker, eth-security-auditor, sui-move-build-helper, defi-threat-scanner, and wallet-security-checker.

Socket traced the attacker infrastructure to a GitHub account named ddjidd564. The Rust crates exfiltrate data to GitHub Gists, while other variants use attacker-controlled GitHub Pages infrastructure. The attacker also submitted pull requests to legitimate AI repositories including langchain-ai and llama_index.

Registries have begun removing flagged packages. The npm listing for token-usage-tracker now shows a Socket malware flag. Other packages remain live at the time of disclosure.

No Confirmed Losses, But the Threat Remains Active

No one has publicly confirmed stolen funds or compromised production projects from this TrapDoor supply chain attack. Socket’s rapid detection and the use of obscure package names suggest minimal successful installations before Socket flagged the malware.

The attacker’s identity remains unknown. Additional undetected packages could still exist across these registries or beyond them. No CVEs or formal GitHub advisories exist yet because Socket disclosed the TrapDoor supply chain attack only hours before this report.

This is not financial advice. Developers should audit their dependencies and check for any of the flagged packages in their projects.

History of Crypto Supply Chain Attacks

The TrapDoor supply chain attack follows a pattern of escalating threats against developers. In 2018, an attacker compromised the popular event-stream npm package to steal Bitcoin wallet data. In 2023, the Ledger Connect Kit compromise affected DeFi protocol frontends serving millions of users.

What sets TrapDoor apart is its coordinated cross-registry approach. Previous attacks typically targeted a single ecosystem at a time. TrapDoor simultaneously hit npm, PyPI, and Crates.io while also adding AI-assistant persistence, a combination not seen before at this scale.

Community Response and Developer Mitigations

On X and developer forums, the response to the TrapDoor supply chain attack mixes alarm with fatigue. Many crypto developers treat supply chain incidents as routine, with one community member posting “Days since last incident: 0.” Others praised Socket’s detection speed and called for stricter registry policies.

The crypto developer community recommends several practical mitigations. Setting min-release-age=7 in package managers prevents installation of packages less than a week old. Running dependency audits with Socket, Snyk, or npm audit can flag known malicious packages.

Developers should also inspect their .cursorrules and CLAUDE.md files for hidden Unicode characters. Sandboxing new package installations in virtual machines adds another layer of protection against install-time payloads.

What Comes Next

Socket continues to monitor for additional TrapDoor variants across all three registries. The initial disclosure on X noted that some packages remain live, and registry teams are still processing takedown requests.

For now, the fastest defense is awareness. Check your dependencies, verify package publishers, and treat unfamiliar security-themed packages with skepticism. The attacker account ddjidd564 and its associated infrastructure remain active at the time of writing. Any developer who installed packages from this account should rotate all credentials immediately.