TrapDoor Malware Campaign Targets Developers on npm, PyPI and Crates.io

Security researchers at Socket Security identified a coordinated supply‑chain attack dubbed “TrapDoor,” in which 34 malicious packages were published across npm, PyPI and Crates.io in 384 different versions. The payloads aim at cryptocurrency and DeFi developers, exfiltrating SSH keys, cloud credentials and other secrets. Attackers timed releases for weekends to reduce detection and used zero‑width Unicode characters to trick AI‑based coding assistants such as Copilot into executing hidden commands.

The campaign leveraged post‑installation scripts in JavaScript, import‑time code in Python and build‑time hooks in Rust to download additional payloads and covertly send data to attacker‑controlled servers. The sophistication of the operation has raised alarm across the software development community, prompting calls for tighter package‑registry monitoring and hardened AI tool safeguards.