TrapDoor malware targets crypto wallets and devs

TLDR

TrapDoor is a new supply-chain malware campaign that hijacks developer tools to steal crypto wallets and access keys from crypto and AI builders.

1. Security firms report TrapDoor hiding in 34+ packages across npm, PyPI, and Crates.io, stealing wallet keys, SSH keys, cloud credentials, and GitHub tokens from developer machines.
2. The campaign targets ecosystems like Solana, Sui, Aptos and popular wallets such as MetaMask and Brave by mimicking audit/helper tools and even abusing AI coding assistants.
3. Developers should urgently audit dependencies, machines, and credentials, while everyday users reduce risk by favoring hardware wallets and being cautious with approvals and security tools.

Deep Dive

1. How TrapDoor Works

Researchers at Socket Security describe TrapDoor as a coordinated supply?chain attack that plants malicious packages in major registries, including npm, PyPI, and Crates.io, across more than 34 packages and over 300380 versions published in waves since late May 2026. These packages execute via normal mechanisms such as npm post?install hooks, Python import side effects, and Rust build scripts, then search infected systems for crypto wallet keystores, SSH keys, AWS credentials, GitHub tokens, browser login databases, and environment variables before exfiltrating them to attacker servers. Reports characterize this as a low?volume but high?impact operation, aimed at a small number of high?value developer environments rather than mass consumer infections.

2. Who Is At Risk

TrapDoor specifically targets developers working on cryptocurrency, DeFi, AI, and security tooling, because they often hold wallet keys and production access. Security write?ups note that affected tooling includes Sui and Move helpers and audit packages like eth?security?auditor, along with generic?sounding utilities that fit normal Web3 workflows. Separate coverage highlights that common targets include environments linked to Coinbase, Binance, Solana, Aptos, MetaMask, and the Brave browser wallet. For end users, the indirect risk is large: once a developers wallets, GitHub tokens, or cloud keys are stolen, attackers can drain project funds, ship malicious updates, or compromise downstream apps and smart contracts.

3. Defenses And What To Watch

SlowMist and other security teams recommend a strict incident?response posture for developers: remove flagged packages, isolate suspected machines, preserve logs, manually inspect AI assistant config files (for example .cursorrules, CLAUDE.md), fully rotate all credentials (wallet keys, API tokens, SSH keys, GitHub PATs, cloud keys), and rebuild development environments from clean images. Going forward, teams should pin dependencies, use allow?lists for registries, scan new packages, and avoid installing security or auditor tools from unknown publishers. For everyday users, keeping larger balances in hardware wallets and using fresh, minimal?permission wallets for dapps limits the damage if a provider is breached. The campaign is ongoing with no public attribution yet, so watching advisories from registries, security firms, and the wallets or protocols you use is critical.

Conclusion

TrapDoor shifts the attack surface from retail users to the developers who build wallets, dapps, and infrastructure, using poisoned packages and AI tooling to steal keys and cloud access. The main defense is discipline: tighter dependency hygiene, aggressive credential rotation after any suspicion of compromise, and conservative wallet practices for both teams and users. If the industry responds quickly, the impact can be contained, but complacency here directly translates into future protocol hacks and drained wallets.