TrapDoor malware campaign targets crypto wallets

TLDR

A new malware campaign called TrapDoor is actively stealing data from crypto-related developer environments and can indirectly expose user wallets.

1. TrapDoor is a coordinated supply chain attack that hides in malicious npm, PyPI, and Rust packages used by crypto and AI developers.
2. It targets wallets and credentials for services like MetaMask, Solana tools, Coinbase, Binance, AWS, and GitHub, aiming to seize direct control over assets and code.
3. Protection relies on hardening developer workflows and keeping private keys off general-purpose machines, with hardware wallets and key rotation as core defenses.

Deep Dive

1. What TrapDoor Is Doing

Security firms Socket and SlowMist report that TrapDoor is an active supply chain attack that has inserted more than 34 malicious packages and over 380 versions into npm, PyPI, and Crates.io, the main registries for JavaScript, Python, and Rust tools used in crypto, DeFi, and AI workspaces. The packages execute through postinstall hooks, Python imports, or Rust build scripts, then scan infected machines for sensitive data such as wallet keystores, SSH keys, cloud credentials, and browser-stored secrets, exfiltrating them to attacker servers in a low-volume but high?impact operation.

TrapDoor stands out because it specifically mimics security or blockchain tooling, with names like audit helpers or wallet checkers, and is tuned to environments where wallet files and infrastructure keys are likely to exist.

2. Who Is At Risk And What Can Be Stolen

The immediate targets are developers and engineers who build or operate crypto and AI systems using package managers and GitHub. Reports say TrapDoor looks for credentials tied to wallets and platforms associated with Coinbase, Binance, Solana, Sui, Aptos, MetaMask, and Brave wallet, along with AWS keys and GitHub tokens that can open up private repos and deployment pipelines.

If a developers workstation that holds production keys is compromised, attackers can potentially sign blockchain transactions, push malicious code, or move funds from custodial or backend wallets, which then impacts end users even if their own devices are clean.

3. Practical Defenses To Focus On

For developers, current guidance from security firms includes removing any flagged TrapDoor packages, rebuilding environments from clean images, and rotating all secrets that may have touched an infected machine, including wallet keys, cloud tokens, and GitHub access. A key nuance is that some variants try to persist via configuration files for AI coding assistants, so checks must include files such as .cursorrules, CLAUDE.md, Git hooks, and IDE configs.

For individual crypto users, the most robust pattern is to ensure your meaningful holdings live behind keys that never touch general-purpose laptops used for coding or browsing, typically via hardware wallets and separate, minimal-use signing devices.

Conclusion

TrapDoor highlights how modern crypto theft increasingly targets the software supply chain rather than just end users or smart contracts. By embedding in everyday developer tools, attackers aim to capture the keys and infrastructure that underpin wallets and protocols. The strongest protection is layered: secure build pipelines and key hygiene on the developer side, and strict separation of long-term private keys from everyday devices on the user side.