TrapDoor malware targets crypto wallets and keys

TLDR

TrapDoor is a new malware campaign that steals crypto wallet data and keys by hiding in developer packages and tools.

1. TrapDoor spreads through poisoned npm, PyPI, and Rust packages, stealing wallet files, SSH keys, cloud credentials, and GitHub tokens from developer machines.
2. It specifically scans for popular crypto wallets and dev stacks, including MetaMask, Solana, Sui, Aptos, Coinbase, Binance, and Brave browser wallet integrations.
3. Developers should treat dependencies as untrusted, audit projects, rotate credentials, and store real funds in hardware wallets, while users should prefer wallets that isolate keys from development environments.

Deep Dive

1. How TrapDoor Steals Wallets And Keys

Security firm Socket and others describe TrapDoor as an active software supply chain attack that hides in over 30 malicious packages and more than 300 versions across npm, PyPI, and Crates.io developer repositories. These packages execute post-install hooks or build scripts that scan infected machines for crypto wallets, SSH keys, AWS credentials, browser password stores, and GitHub tokens, then exfiltrate them to attacker servers.

Reports note that TrapDoor also drops configuration files such as `.cursorrules` and `CLAUDE.md` to hijack AI coding assistants like Claude and Cursor, tricking them into running fake security scans that help discover and leak secrets from project directories. This shifts the attack from classic malware toward manipulating developer workflows and AI tools to expose private keys and access tokens.

2. Who Is Most At Risk

TrapDoor focuses on developers who build or manage crypto and AI infrastructure. It targets environments linked to wallets and platforms such as Coinbase, Binance, MetaMask, Brave, and ecosystems around Solana, Sui, Aptos and DeFi tooling, according to multiple analyses of the campaign.

By compromising a developer workstation, attackers can obtain:

1. direct access to personal wallets on that machine,
2. credentials for cloud backends and CI pipelines,
3. GitHub tokens that allow tampering with project code.

3. How To Reduce Your Risk

For developers, Socket and other researchers recommend treating all dependencies as potentially malicious. Practical steps include pinning and auditing dependencies, using package lock files, and running automated security scanners that flag suspicious install scripts or package names that mimic popular tools.

If there is any chance a workstation has installed a TrapDoor-linked package, response should be aggressive: revoke and reissue all wallet keys, SSH keys, cloud credentials, and GitHub tokens, then rebuild machines from clean images as SlowMist-style guidance suggests.

For everyday crypto users, the key defense is isolation. Keep meaningful funds in hardware wallets or dedicated devices that never install development toolchains or experimental browser extensions, and enable multi-factor authentication on exchanges and GitHub or cloud accounts that touch your crypto operations.

Conclusion

TrapDoor shows how modern crypto theft increasingly targets the developer supply chain instead of only exploiting smart contracts or end users directly. If developers harden their environments and users segregate real funds from risky tooling, the window for this type of wallet and key theft narrows significantly, even as attackers experiment with AI-assisted and package-based intrusion methods.