TrapDoor campaign plants 34 poisoned npm, PyPI and Crates packages to steal wallets, SSH keys and API tokens
Security firm Socket uncovered a supply‑chain malware operation called "TrapDoor" that distributed 34 compromised packages across npm, PyPI and Crates to target crypto and AI developer tooling [1][2].
Researchers at Socket identified a sophisticated campaign named TrapDoor that placed 34 compromised packages in popular developer repositories including npm, PyPI and Crates, enabling the malware to reach developer supply chains via poisoned packages [1] [2].
The operation specifically targeted developers working on cryptocurrency, decentralized finance, artificial intelligence and cybersecurity projects and was designed to harvest wallet data, SSH credentials, cloud access tokens and API authentication keys; reported targets and integrations of interest include Coinbase, Binance, Solana, MetaMask and Brave wallet functionality [1] [2] [3].
The campaign has been covered across security outlets and community forums following Socket's disclosure, with ongoing analysis of the 34 identified malicious packages and their distribution vectors reported by multiple outlets [1] [4] [3].
Anonymous signal used only for weekly cluster rankings. No public counters.
Share
Broadcast this coverage
Copy-ready links for the networks your audience checks first.
Support independent reporting
If this summary helped, a small tip helps keep ClusterWire running.
Privacy note: we log tip UI events (page + action, and article slug when applicable) to improve the feature. We don’t store IP address, user-agent, or wallet addresses in analytics. Tips are on-chain, so the sending address is public in the transaction.
Citations
Follow the primary reporting behind this analysis. Click a citation to open the referenced source in a new tab.
- 1TrapDoor Malware Campaign Infiltrates Developer Supply Chains to Target Crypto and AI ProjectsBlockonomi• May 25, 2026
- 2TrapDoor Supply Chain Attack Compromises 34 Packages Targeting Crypto and AI DevelopersMoneyCheck• May 25, 2026
- 3TrapDoor malware campaign steals crypto wallet data through fake developer toolscrypto.news• May 25, 2026
- 4TrapDoor Malware Targets Crypto Developer Tools in Supply Chain Attackr/CryptoCurrency• May 25, 2026
Themes
Themes driving this story
Curated from the cluster of sources powering this article.