TrapDoor malware targets crypto wallets and developers

TLDR

TrapDoor is an active malware campaign that hides in developer packages to steal crypto wallets and sensitive credentials from crypto and AI builders.

1. Researchers found more than 34 malicious packages and 384 versions on npm, PyPI, and Crates.io that form a coordinated supply chain attack on developer tools.
2. TrapDoor focuses on high value targets such as MetaMask, Solana, Sui, Aptos, Coinbase, Binance, and cloud and GitHub credentials, putting both project funds and user assets at risk.
3. Developers and advanced users should treat dependencies and AI coding setups as attack surfaces, tighten key management, and monitor security advisories for affected packages and repos.

Deep Dive

1. Supply Chain Malware, Not a Simple Virus

Socket Security reports that TrapDoor is an ongoing supply chain attack that plants malicious packages across npm, PyPI, and Rusts Crates, with over 34 packages and 384 versions released in waves to avoid detection. Coverage from Cointelegraph describes it as an active campaign aiming to steal wallet data, SSH keys, cloud credentials, GitHub tokens, browser extension data, and API keys by masquerading as normal developer helpers and security tools in those registries. Developers trigger the malware simply by installing or importing these packages, which then execute post?install scripts or build hooks that scan the machine and exfiltrate secrets to attacker servers.

2. Wallets, Clouds, And AI Tools In The Crosshairs

Reports highlight that TrapDoor specifically looks for data tied to wallets and platforms such as Coinbase, Binance, MetaMask, Brave, Solana, Sui, and Aptos, along with AWS keys and GitHub tokens, giving attackers potential access to both funds and codebases. Sockets CTO notes that some packages inject hidden instructions into AI coding assistants like Claude and Cursor, tricking them into running fake security scans that locate and leak secrets. SlowMists analysis adds that TrapDoor is designed for full developer workstation compromise, embedding itself into configuration files like `.cursorrules` and `CLAUDE.md`, Git hooks, and automation scripts, especially in Sui and Move tooling.

3. Practical Defenses For Devs And Power Users

For developers, security teams are recommending a few priorities rather than any single silver bullet: verify package publishers and popularity before installing, pin and review dependencies, and react quickly to advisories listing malicious package names. Secrets such as wallet keys, AWS credentials, and GitHub tokens should be stored in hardware wallets or dedicated secret managers, never left in plain text or browser storage on the same machine that pulls unvetted packages. If you suspect you installed an affected package, conservative practice is to revoke and rotate all keys and tokens, review AI assistant config files and Git hooks, and, in higher risk cases, rebuild the environment from clean images. Regular users who are not developers reduce exposure by using hardware or mobile wallets where the private key never touches a development environment or browser plugins used for coding.

Conclusion

TrapDoor does not attack blockchains directly, but instead compromises the developers and tools that hold keys and deploy code, which can cascade into thefts and protocol compromises. As supply chain and AI?assisted attacks proliferate, the edge shifts to teams that harden their developer workflows, aggressively rotate credentials after any suspicion, and keep wallet keys off machines that touch untrusted code.