--- title: TrapDoor Crypto Stealer Supply Chain Attack Hits 34... description: Socket researchers have uncovered TrapDoor, an active supply chain attack spanning 34+ malicious packages across npm, PyPI, and Crates.io. The campaign targets... canonical: https://daily.dev/posts/trapdoor-crypto-stealer-supply-chain-attack-hits-34-packages--jebsi326a twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages... | daily.dev og:description: Socket researchers have uncovered TrapDoor, an active supply chain attack spanning 34+ malicious packages across npm, PyPI, and Crates.io. The campaign targets... og:url: https://daily.dev/posts/trapdoor-crypto-stealer-supply-chain-attack-hits-34-packages--jebsi326a og:image: https://api.daily.dev/og/posts/jEbSI326A.png og:image:alt: TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages... og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages... **[Socket](https://daily.dev/sources/socketdev)** · 11 min read · 0 upvotes · 0 comments ## Summary Socket researchers have uncovered TrapDoor, an active supply chain attack spanning 34+ malicious packages across npm, PyPI, and Crates.io. The campaign targets crypto, DeFi, Solana, and AI developers, stealing SSH keys, crypto wallet data, AWS credentials, GitHub tokens, browser data, and environment variables. npm packages use postinstall hooks to deploy a 1,149-line credential harvester (trap-core.js) with persistence via .cursorrules, CLAUDE.md, Git hooks, systemd, and cron. PyPI packages execute remote JavaScript on import, while Crates.io packages abuse build.rs scripts to exfiltrate keystores via GitHub Gists. A novel feature involves injecting hidden Unicode instructions into AI coding tool config files (.cursorrules, CLAUDE.md) to trick AI assistants into running fake 'security scans' that exfiltrate data. The attacker also opened PRs against major open source AI projects (LangChain, LlamaIndex, MetaGPT) to plant malicious config files. Socket detected packages in under 6 minutes on average and has reported all identified packages to affected registries. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [TrapDoor malware campaign puts developer workstations in CISO spotlight](https://daily.dev/posts/trapdoor-malware-campaign-puts-developer-workstations-in-ciso-spotlight-i8q0wnnkh) · CSO Online · 1 upvotes · 0 comments - [New npm worm hits CI pipelines and AI coding tools](https://daily.dev/posts/new-npm-worm-hits-ci-pipelines-and-ai-coding-tools-3fx3mdyns) · InfoWorld · 0 upvotes · 0 comments - [New IronWorm malware hits 36 packages in npm supply-chain attack](https://daily.dev/posts/new-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack-2rfjqmxiq) · BleepingComputer · 62 upvotes · 20 comments - [Four More Supply Chain Attacks Hit npm and PyPI](https://daily.dev/posts/four-more-supply-chain-attacks-hit-npm-and-pypi-g68buqqbp) · GitGuardian · 7 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/trapdoor-crypto-stealer-supply-chain-attack-hits-34-packages--jebsi326a) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages...","url":"https://daily.dev/posts/trapdoor-crypto-stealer-supply-chain-attack-hits-34-packages--jebsi326a","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/trapdoor-crypto-stealer-supply-chain-attack-hits-34-packages--jebsi326a"},"datePublished":"2026-05-24T16:32:05.852Z","dateModified":"2026-05-24T16:32:32.419Z","description":"Socket researchers have uncovered TrapDoor, an active supply chain attack spanning 34+ malicious packages across npm, PyPI, and Crates.io. The campaign targets...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/52536f08332c357eb7ca20ea7d9008ea?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/52536f08332c357eb7ca20ea7d9008ea?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/trapdoor-crypto-stealer-supply-chain-attack-hits-34-packages--jebsi326a","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,malware,npm","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages..."}]} ```