A supply-chain attack called TrapDoor planted more than 34 malicious packages, spread across 384 related versions, on the npm, PyPI and Crates.io registries to steal wallet keys and credentials from crypto, DeFi and AI developers. Security firm Socket, which uncovered the campaign, traced the earliest package to a PyPI upload on May 22, 2026, and said the malware was built to harvest Solana, Sui and Aptos wallet data along with SSH keys, GitHub tokens, AWS credentials and browser logins. Socket reported the packages to the affected registries and has not identified any confirmed victims or stolen funds, but the design points at a specific, high-value target: the laptops where builders keep wallets and production access in the same place.
A supply-chain attack is one that compromises the software a developer downloads and trusts, rather than attacking that developer directly. Instead of phishing an individual, the attacker poisons a package other people install.
Key takeaways
- Socket found 34+ malicious packages and 384+ versions across npm, PyPI and Crates.io in a campaign it named TrapDoor, first seen May 22, 2026.
- The packages posed as crypto and AI developer tools and were built to steal Solana, Sui and Aptos wallet data, SSH keys, GitHub tokens, AWS credentials and browser data.
- The attacker planted hidden instructions in .cursorrules and CLAUDE.md files to trick AI coding assistants into running fake security scans that exfiltrate secrets.
- Socket flagged the malicious releases in a median of 5 minutes and 27 seconds and reported no confirmed thefts.
Published: May 29, 2026, 16:00 UTC
What happened and why it matters
Socket researchers said earlier this week they identified the campaign across the three registries that crypto and AI engineers rely on most: npm for JavaScript, PyPI for Python and Crates.io for Rust. The earliest package the firm observed was eth-security-auditor on PyPI, uploaded May 22 at 20:20 UTC, followed by waves of releases from a handful of accounts over the weekend.
The targeting is the point. Supply-chain attacks built around developer tooling are not trying to catch random retail users. They go after the people who tend to keep wallet files, SSH keys, GitHub tokens, cloud credentials and live production access on the same machine they use to build crypto and AI software. One stolen credential from that kind of workstation can open a path into an entire company’s infrastructure.
The package names were boring on purpose. Socket listed entries such as wallet-security-checker, defi-risk-scanner, solidity-build-guard, move-compiler-tools and llm-context-compressor: the kind of small utility a developer installs without a second look. That disguise is what let the campaign reach across crypto, DeFi and AI tooling communities at once.
How the malware reaches developer machines
TrapDoor used a different trigger on each registry so the code would run during normal install, build or import steps. The npm packages relied on postinstall hooks, scripts that run automatically right after a package is installed. Once triggered, they ran a shared payload called trap-core.js, a 1,149-line credential harvester that searched for private keys, passwords, GitHub tokens and cloud logins, then validated stolen AWS and GitHub credentials through API calls to sort live keys from dead ones.
The Rust packages on Crates.io used malicious build.rs scripts that execute during compilation, before a developer runs any of the package’s functions. Those scripts hunted for local wallet keystores, encrypted them with a hardcoded key and pushed the data out to GitHub Gists. The PyPI packages ran on import, pulling JavaScript from an attacker-controlled GitHub Pages site and executing it. Socket also saw the npm payload reuse stolen SSH keys to move into other systems and drop persistence files through Git hooks, shell hooks, systemd, cron and SSH, turning a one-time theft into a lasting foothold.
The AI angle
The most unusual part of TrapDoor targets AI coding assistants. The malware wrote hidden instructions into .cursorrules and CLAUDE.md files, which developers normally use to give project-specific guidance to tools like Cursor and Claude. Socket said the attacker used zero-width Unicode characters to conceal directives that try to make a future AI session run a “security scan” that quietly collects and sends out secrets.
The attacker did not stop at registry uploads. The same GitHub account opened pull requests against widely used AI and developer projects, including LangChain, LlamaIndex, MetaGPT and browser-use, each one proposing to add a .cursorrules or CLAUDE.md file under titles about “dev standards and build verification.” It is an attempt to slip campaign-linked instructions into trusted repositories through ordinary open-source contribution paths, where AI tools might later read and act on them.
What comes next
Socket said it reported every identified package to npm, PyPI and Crates.io and classified the campaign as malicious, though some versions were still live at the time of writing. The firm detected the releases quickly, with a median flag time of 5 minutes and 27 seconds and a fastest catch of 58 seconds, which likely limited adoption. No confirmed victims or stolen funds have been reported.
For crypto and AI teams, the practical response is to audit recently installed packages against Socket’s published list, rotate any SSH keys, GitHub tokens and cloud credentials that touched an affected machine, and review .cursorrules and CLAUDE.md files for instructions no one wrote. Expect more campaigns shaped like this one. The install is no longer the prize. The workstation is, along with whatever an AI assistant reads next.
Frequently asked questions
What is the TrapDoor attack?
TrapDoor is a supply-chain malware campaign found by security firm Socket. It planted more than 34 malicious packages across the npm, PyPI and Crates.io registries, disguised as crypto and AI developer tools, to steal wallet data, SSH keys and cloud credentials from the developers who installed them.
Which crypto wallets were targeted?
Socket said the packages were built to harvest Solana, Sui and Aptos wallet data, along with crypto wallet browser extension data and local keystores. The Rust packages on Crates.io specifically targeted Sui and Move developers during the build process.
How does TrapDoor abuse AI coding tools?
The malware planted hidden instructions, concealed with zero-width Unicode characters, in .cursorrules and CLAUDE.md configuration files. These files guide AI assistants like Cursor and Claude, and the directives tried to make future AI sessions run a fake security scan that exfiltrates secrets.
