TrapDoor malware targets crypto and AI developers

TLDR

TrapDoor is a newly uncovered malware campaign that plants malicious packages in popular code registries to steal keys and credentials from crypto and AI developers.

1. TrapDoor uses over 30 fake packages on npm, PyPI, and Crates.io to infect developer machines and exfiltrate wallet keys, SSH keys, cloud logins, and browser data.
2. The campaign specifically targets crypto, DeFi and AI tooling, including Solana, Sui and Aptos wallet data, and even hijacks AI coding assistants via hidden instructions.
3. The main defenses are strict dependency hygiene, secret isolation, and treating AI agents and security tools as untrusted code that must be reviewed and sandboxed.

Deep Dive

1. How TrapDoor Works

Security firm Socket reports that TrapDoor is a large supply chain attack that seeded more than 34 malicious packages, with hundreds of versions, across npm, PyPI, and Crates.io. These were disguised as tools like "wallet-security-checker" and "defi-risk-scanner" and classified as harmful after analysis.

Once installed, the packages search local machines for private keys, passwords, GitHub tokens, AWS credentials, and browser data, then validate and use SSH keys for lateral movement while establishing persistence. CoinDesk describes this as a focused campaign against developer environments rather than general end users, turning workstations into targets containing both wallets and production access.

2. Why Crypto And AI Devs Are Exposed

Reports note that TrapDoor targets crypto, DeFi, AI and security developers, including Sui and Move ecosystems, with Rust packages that run malicious build scripts and JavaScript or Python code that executes on import. One analysis highlights Solana, Sui and Aptos wallet data as explicit targets in the TrapDoor package attack.

The campaign also abuses AI coding tools by editing files such as `.cursorrules` and `CLAUDE.md`, embedding invisible Unicode instructions that can push AI assistants to run fake security scans that secretly exfiltrate secrets in future sessions. This bridges supply chain malware and AI prompt injection in one operation.

3. Defenses And What To Watch

Practical defenses include:

1. Treat all new dependencies and security utilities as untrusted, preferring pinned versions, well known publishers, and code review over blindly installing generic packages.
2. Separate concerns on your machine, keeping hot wallets and production credentials off general development laptops where possible, and rotate keys if you may have installed affected packages.
3. Audit AI assistant config files regularly, disable unneeded agents, and adopt a zero trust model where AI tools cannot access secrets or run shell commands without explicit checks.

Future incidents to watch include follow up reports on confirmed victims, additional registries being abused, and new malware that blends supply chain attacks with AI agent manipulation.

Conclusion

TrapDoor shows how attackers now target the software supply chain around crypto and AI, not just wallets and protocols directly. The main edge for developers is disciplined dependency management, strict secret isolation, and treating AI tooling as potentially hostile code, which together can significantly reduce the blast radius of this kind of campaign.