Security firm Socket says a supply-chain campaign called TrapDoor is targeting crypto developers, with a focus on environments tied to Solana, Sui and Aptos. According to the researchers, the operation appeared across npm, PyPI and Crates.io and involved more than 34 malicious packages along with hundreds of related versions and artifacts.
The campaign is not built to snare random retail users. Its target is the developer workstation. That matters because those machines can hold wallet files, SSH keys, GitHub tokens, cloud credentials and direct access to production systems at the same time.
Malicious packages posed as ordinary developer utilities
Socket said the packages were written in JavaScript, Python and Rust and disguised as routine tools a crypto or AI developer might install without much scrutiny. They appeared as developer helpers, security scanners, wallet tools, Solidity utilities, AI prompt packages, and Sui or Move build helpers. Reported names included “wallet-security-checker”, “defi-risk-scanner”, “solidity-build-guard”, “move-compiler-tools” and “llm-context-compressor”.
Once installed, the behavior shifted fast. In the npm samples, the malware searched local machines for private keys, passwords, GitHub tokens and cloud logins. Socket said it also tested some of the stolen credentials, tried to pivot into other systems through SSH keys, and dropped files meant to keep access active.
That raises the stakes. SSH keys are commonly used to log into servers, code repositories and other machines, so stealing them can let an attacker move beyond a single laptop and into a company’s broader infrastructure.
Campaign also tampered with files read by AI coding assistants
Socket said the attack used files such as .cursorrules and claude.md, which developers use to set project-specific instructions for AI coding tools. Researchers found hidden instructions planted with zero-width Unicode characters. The apparent goal was to influence future AI assistant sessions into running fake “security scans” that collected and exfiltrated secrets.
That changed the nature of the operation. The package install was only the first step; the real objective was the wider developer environment, including wallets, repositories, browser data, cloud keys, SSH access and any content that AI coding tools might read next.
Different registries used different execution paths
On the technical side, the Rust packages used malicious build.rs scripts that ran during compilation and were aimed at Sui and Move developers. PyPI packages executed remote JavaScript on import. On npm, the malware relied on postinstall hooks to trigger its payload.
Socket did not identify victims or disclose any stolen funds. Still, it said the malicious packages were live across the three major registries and carried payloads capable of stealing wallet data, exfiltrating credentials, testing AWS and GitHub tokens, and leaving files behind to maintain access.
The company also warned that the attacker tried to use ordinary open-source contribution channels. According to Socket, pull requests were opened against AI and developer projects in an attempt to add .cursorrules and CLAUDE.md files. Socket said it has reported the packages to the affected registries and classified the campaign as malicious.