Socket researchers have uncovered TrapDoor, an active supply chain attack spanning 34+ malicious packages across npm, PyPI, and Crates.io. The campaign targets crypto, DeFi, Solana, and AI developers, stealing SSH keys, crypto wallet data, AWS credentials, GitHub tokens, browser data, and environment variables. npm packages use postinstall hooks to deploy a 1,149-line credential harvester (trap-core.js) with persistence via .cursorrules, CLAUDE.md, Git hooks, systemd, and cron. PyPI packages execute remote JavaScript on import, while Crates.io packages abuse build.rs scripts to exfiltrate keystores via GitHub Gists. A novel feature involves injecting hidden Unicode instructions into AI coding tool config files (.cursorrules, CLAUDE.md) to trick AI assistants into running fake 'security scans' that exfiltrate data. The attacker also opened PRs against major open source AI projects (LangChain, LlamaIndex, MetaGPT) to plant malicious config files. Socket detected packages in under 6 minutes on average and has reported all identified packages to affected registries.
