{"investigation":{"slug":"trapdoor-supply-chain-attack","entity_name":"TrapDoor Supply Chain Attack","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.92,"status":"draft","content_type":"investigation","summary":"TrapDoor is a coordinated cross-ecosystem software supply chain attack first observed on May 22, 2026, distributing credential-stealing malware across npm, PyPI, and Crates.io via 34+ malicious packages spanning 384+ versions. The campaign targets crypto, DeFi, Solana, Sui, Aptos, and AI developers by harvesting wallet keystores, SSH keys, cloud credentials, and browser session data, and is notable for a novel technique that poisons AI coding assistant configuration files to silently exfiltrate secrets. Security firm Socket and blockchain security firm SlowMist both described TrapDoor as one of the most significant supply chain attacks of 2026.","sections":[{"content":"TrapDoor is a multi-ecosystem malware campaign first detected by Socket's threat intelligence team on May 22, 2026, at approximately 20:20 UTC, when the earliest confirmed artifact — eth-security-auditor 0.1.0 — was uploaded to PyPI. The campaign spans three package registries (npm, PyPI, and Crates.io) and 34+ distinct malicious packages across 384+ versions, targeting developer communities involved in cryptocurrency, DeFi, Solana, Sui, Aptos, and AI tooling. SlowMist described TrapDoor as 'one of the largest cross-platform supply chain attacks seen in 2026.' The campaign was coordinated from a single GitHub account identified as 'ddjidd564', which hosted exfiltration infrastructure at ddjidd564.github.io and was used to open pull requests against popular AI projects. Socket formally reported all identified packages to the affected registries for removal.","heading":"Campaign Overview","sources":[{"url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates","name":"TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages — Socket","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html","name":"TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and Crates.io — The Hacker News","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/05/28/slowmist-says-trapdoor-is-one-of-2026s-largest-supply-chain-attacks/","name":"SlowMist Says TrapDoor Is One of 2026's Largest Supply Chain Attacks — CryptoTimes","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Socket identified the following packages as part of the TrapDoor campaign. npm (21 packages): async-pipeline-builder, build-scripts-utils, chain-key-validator, crypto-credential-scanner, defi-env-auditor, defi-threat-scanner, deployment-key-auditor, dev-env-bootstrapper, eth-wallet-sentinel, llm-context-compressor, mnemonic-safety-check, model-switch-router, node-setup-helpers, project-init-tools, prompt-engineering-toolkit, solidity-deploy-guard, token-usage-tracker, wallet-backup-verifier, wallet-security-checker, web3-secrets-detector, workspace-config-loader. PyPI (7 packages): cryptowallet-safety, data-pipeline-check, defi-risk-scanner, env-loader-cli, eth-security-auditor, git-config-sync, solidity-build-guard. Crates.io (6 packages): move-analyzer-build, move-compiler-tools, move-project-builder, sui-framework-helpers, sui-move-build-helper, sui-sdk-build-utils. Package names were deliberately chosen to appear benign and security-oriented, mimicking legitimate developer utility names in order to deceive developers into installation.","heading":"Malicious Packages","sources":[{"url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates","name":"TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages — Socket","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html","name":"TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and Crates.io — The Hacker News","type":"news_article","credibility":2}],"severity":"critical"},{"content":"TrapDoor employs ecosystem-specific execution paths to ensure automatic activation at install or build time. npm packages use postinstall hooks to trigger a 1,149-line JavaScript payload named 'trap-core.js', which scans for developer credentials, validates stolen AWS and GitHub tokens via live API calls, and establishes persistence through cron jobs, systemd services, Git hooks, and SSH lateral movement mechanisms. PyPI packages execute remote JavaScript payloads on import by downloading code from ddjidd564.github.io/defi-security-best-practices/ and running it via 'node -e', enabling the attacker to update payloads post-publication without modifying the package itself. Crates.io packages use malicious build.rs scripts that execute during compilation, searching local keystores, encrypting harvested data using a hardcoded XOR key, and exfiltrating it to GitHub Gists. The campaign marker 'P-2024-001' was embedded in the infrastructure. Socket researchers noted that the GitHub activity showed 'signs of rapid, AI-assisted-style iteration', suggesting possible automated or AI-accelerated campaign development.","heading":"Technical Execution and Payload Mechanics","sources":[{"url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates","name":"TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages — Socket","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html","name":"TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and Crates.io — The Hacker News","type":"news_article","credibility":2},{"url":"https://www.technadu.com/trapdoor-supply-chain-attack-targets-npm-pypi-and-crates-io-steals-credentials-crypto/628350/","name":"TrapDoor Supply Chain Attack Targets npm, PyPI, and Crates.io — TechNadu","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The TrapDoor malware is designed to harvest a broad range of developer credentials and secrets. Confirmed exfiltration targets include: Solana, Sui, and Aptos wallet keystores and private key files; SSH keys enabling server and infrastructure access; AWS credentials and cloud configuration files; GitHub tokens; browser login databases and session data; crypto wallet browser extension data; CI/CD environment variables; and general API keys and development configuration files. CoinDesk noted that crypto and DeFi developers are particularly valuable targets because they 'may have wallet files, SSH keys, GitHub tokens, cloud credentials and production access on the same machine', concentrating multiple high-value secrets in a single compromised environment. Stolen data was transmitted to attacker-controlled servers using trusted services including GitHub Pages, GitHub Gists, and webhook.site to blend malicious traffic with legitimate service traffic.","heading":"Data Exfiltration Targets","sources":[{"url":"https://www.coindesk.com/tech/2026/05/29/solana-sui-and-aptos-wallet-data-targeted-in-trapdoor-package-attack","name":"Solana, Sui and Aptos Wallet Data Targeted in TrapDoor Package Attack — CoinDesk","type":"news_article","credibility":1},{"url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates","name":"TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages — Socket","type":"research","credibility":2},{"url":"https://www.cryptotimes.io/2026/05/28/slowmist-says-trapdoor-is-one-of-2026s-largest-supply-chain-attacks/","name":"SlowMist Says TrapDoor Is One of 2026's Largest Supply Chain Attacks — CryptoTimes","type":"news_article","credibility":2}],"severity":"critical"},{"content":"TrapDoor introduced a novel technique targeting AI coding assistants such as Cursor and Claude Code. The campaign's npm payload implanted malicious .cursorrules and CLAUDE.md files containing hidden instructions encoded using zero-width Unicode characters. These characters render as blank or invisible content in standard text editors but are fully parsed by AI coding tools, which process the complete Unicode stream. The hidden instructions were designed to trigger a simulated 'security scan' workflow within the AI assistant's context, causing the tool to discover and exfiltrate local secrets on the developer's behalf — effectively turning a trusted AI tool into a credential harvesting agent. To test and spread this vector at scale, the threat actor operating the 'ddjidd564' GitHub account opened pull requests against several popular open-source AI projects, including browser-use/browser-use, langchain-ai/langchain, langflow-ai/langflow, run-llama/llama_index, FoundationAgents/MetaGPT, and OpenHands/OpenHands. The PRs carried benign-sounding titles such as 'docs: add .cursorrules with dev standards and build verification'. SlowMist warned that this technique could propagate malicious behavior through future AI-assisted coding sessions via prompt injection, representing an emerging and novel threat vector as AI tools become standard in developer workflows.","heading":"AI Coding Assistant Poisoning","sources":[{"url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates","name":"TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages — Socket","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html","name":"TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and Crates.io — The Hacker News","type":"news_article","credibility":2},{"url":"https://www.thecybersignal.com/trapdoor-npm-pypi-crates-supply-chain-ai-assistant-poisoning-2026/","name":"TrapDoor Attack Hits npm, PyPI, Crates.io — Poisons AI Tools — The Cyber Signal","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/05/28/slowmist-says-trapdoor-is-one-of-2026s-largest-supply-chain-attacks/","name":"SlowMist Says TrapDoor Is One of 2026's Largest Supply Chain Attacks — CryptoTimes","type":"news_article","credibility":2}],"severity":"critical"},{"content":"All identified attack infrastructure is linked to the GitHub account 'ddjidd564'. The attacker used GitHub Pages (ddjidd564.github.io/defi-security-best-practices/) as a payload hosting domain for PyPI packages and GitHub Gists as a data exfiltration channel for Crates.io packages. The campaign marker 'P-2024-001' was embedded in infrastructure artifacts. The same account opened pull requests against six prominent AI open-source projects in what researchers believe was a test of the AI assistant poisoning vector. No nation-state or individual attribution has been publicly confirmed. Socket noted that the development pattern showed signs of 'rapid, AI-assisted-style iteration', though this characterization is based on behavioral inference rather than confirmed attribution. The threat actor's identity, nationality, and affiliations remain unknown as of June 2026.","heading":"Infrastructure and Attribution","sources":[{"url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates","name":"TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages — Socket","type":"research","credibility":2},{"url":"https://www.technadu.com/trapdoor-supply-chain-attack-targets-npm-pypi-and-crates-io-steals-credentials-crypto/628350/","name":"TrapDoor Supply Chain Attack Targets npm, PyPI, and Crates.io — TechNadu","type":"news_article","credibility":2}],"severity":"high"},{"content":"Socket's automated threat detection system identified TrapDoor releases with an average response time of 5 minutes and 56 seconds across 381 package-version records, with a median detection time of 5 minutes and 27 seconds. The fastest single detection was 58 seconds after package publication. Socket formally reported all identified malicious packages to npm, PyPI, and Crates.io for removal. As of reporting, full takedown confirmation across all three registries had not been publicly documented, and security advisories from each registry had not been individually confirmed. Developers who installed any of the named packages during the campaign window should treat their development environments as potentially compromised and rotate all credentials, SSH keys, cloud tokens, and wallet keystores. Socket noted the malware was designed to evade standard software composition analysis and SBOM (Software Bill of Materials) scanning tools.","heading":"Detection and Registry Response","sources":[{"url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates","name":"TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages — Socket","type":"research","credibility":2},{"url":"https://cyberpress.org/supply-chain-attack-compromises-34-packages/","name":"Supply Chain Attack Compromises 34 Packages Across npm, PyPI, Crates — CyberPress","type":"news_article","credibility":2},{"url":"https://phoenix.security/trapdoor-supply-chain-ai-poisoning-npm-pypi-crates/","name":"TrapDoor Supply Chain Attack: AI Poisoning via npm, PyPI — Phoenix Security","type":"research","credibility":2}],"severity":"high"},{"content":"TrapDoor was explicitly designed to target high-value developer environments rather than retail end users. The primary target communities are: cryptocurrency and DeFi protocol developers; Solana ecosystem developers; Sui and Aptos (Move language) developers; and AI tooling developers using frameworks such as LangChain, LlamaIndex, and browser automation tools. These communities were selected because their developer machines are likely to contain a concentration of high-value secrets including wallet private keys, protocol admin keys, cloud infrastructure access, and production deployment credentials. No confirmed victim accounts or verified theft amounts have been publicly reported as of June 2026. Socket stated it did not identify specific victims or confirmed stolen funds at the time of initial disclosure.","heading":"Affected Developer Communities and Risk Profile","sources":[{"url":"https://www.coindesk.com/tech/2026/05/29/solana-sui-and-aptos-wallet-data-targeted-in-trapdoor-package-attack","name":"Solana, Sui and Aptos Wallet Data Targeted in TrapDoor Package Attack — CoinDesk","type":"news_article","credibility":1},{"url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates","name":"TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages — Socket","type":"research","credibility":2}],"severity":"high"}],"timeline":[{"date":"2026-05-22","event":"Earliest confirmed malicious artifact, eth-security-auditor 0.1.0, uploaded to PyPI at 20:20:18 UTC. Additional packages published in waves across npm, PyPI, and Crates.io.","source":"Socket threat intelligence report","source_url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates"},{"date":"2026-05-22","event":"Socket's automated detection systems begin flagging TrapDoor packages, with an average detection latency of 5 minutes 56 seconds and a fastest detection of 58 seconds post-publication.","source":"Socket threat intelligence report","source_url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates"},{"date":"2026-05-25","event":"The Hacker News publishes initial public coverage of the TrapDoor supply chain campaign, citing Socket's research.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html"},{"date":"2026-05-28","event":"SlowMist characterizes TrapDoor as 'one of the largest cross-platform supply chain attacks seen in 2026', citing coordinated infrastructure across npm, PyPI, and Crates.io.","source":"CryptoTimes reporting on SlowMist findings","source_url":"https://www.cryptotimes.io/2026/05/28/slowmist-says-trapdoor-is-one-of-2026s-largest-supply-chain-attacks/"},{"date":"2026-05-29","event":"CoinDesk reports on the campaign's specific targeting of Solana, Sui, and Aptos wallet keystores, highlighting the risk to DeFi developers.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/05/29/solana-sui-and-aptos-wallet-data-targeted-in-trapdoor-package-attack"},{"date":"2026-05-29","event":"Socket formally reports all 34+ identified malicious packages to npm, PyPI, and Crates.io registries for removal.","source":"Socket threat intelligence report","source_url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates"}],"sources_used":[{"url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates","name":"TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages — Socket","type":"research","archive_url":"http://web.archive.org/web/20260610050213/https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates","credibility":2,"archive_timestamp":"2026-06-10T05:02:13+00:00"},{"url":"https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html","name":"TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and Crates.io — The Hacker News","type":"news_article","archive_url":"http://web.archive.org/web/20260720092839/https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html","credibility":2,"archive_timestamp":"2026-07-20T09:28:39+00:00"},{"url":"https://www.coindesk.com/tech/2026/05/29/solana-sui-and-aptos-wallet-data-targeted-in-trapdoor-package-attack","name":"Solana, Sui and Aptos Wallet Data Targeted in TrapDoor Package Attack — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260704034620/https://www.coindesk.com/tech/2026/05/29/solana-sui-and-aptos-wallet-data-targeted-in-trapdoor-package-attack","credibility":1,"archive_timestamp":"2026-07-04T03:46:20+00:00"},{"url":"https://www.cryptotimes.io/2026/05/28/slowmist-says-trapdoor-is-one-of-2026s-largest-supply-chain-attacks/","name":"SlowMist Says TrapDoor Is One of 2026's Largest Supply Chain Attacks — CryptoTimes","type":"news_article","archive_url":"https://web.archive.org/web/20260725055639/https://www.cryptotimes.io/2026/05/28/slowmist-says-trapdoor-is-one-of-2026s-largest-supply-chain-attacks/","credibility":2,"archive_timestamp":"2026-07-25T05:56:39+00:00"},{"url":"https://www.technadu.com/trapdoor-supply-chain-attack-targets-npm-pypi-and-crates-io-steals-credentials-crypto/628350/","name":"TrapDoor Supply Chain Attack Targets npm, PyPI, and Crates.io — TechNadu","type":"news_article","archive_url":"http://web.archive.org/web/20260725102506/https://www.technadu.com/trapdoor-supply-chain-attack-targets-npm-pypi-and-crates-io-steals-credentials-crypto/628350/","credibility":2,"archive_timestamp":"2026-07-25T10:25:06+00:00"},{"url":"https://phoenix.security/trapdoor-supply-chain-ai-poisoning-npm-pypi-crates/","name":"TrapDoor Supply Chain Attack: AI Poisoning via npm, PyPI — Phoenix Security","type":"research","archive_url":"https://web.archive.org/web/20260724231514/https://phoenix.security/trapdoor-supply-chain-ai-poisoning-npm-pypi-crates/","credibility":2,"archive_timestamp":"2026-07-24T23:15:14+00:00"},{"url":"https://cyberpress.org/supply-chain-attack-compromises-34-packages/","name":"Supply Chain Attack Compromises 34 Packages Across npm, PyPI, Crates — CyberPress","type":"news_article","archive_url":"https://web.archive.org/web/20260724223336/https://cyberpress.org/supply-chain-attack-compromises-34-packages/","credibility":2,"archive_timestamp":"2026-07-24T22:33:36+00:00"},{"url":"https://www.thecybersignal.com/trapdoor-npm-pypi-crates-supply-chain-ai-assistant-poisoning-2026/","name":"TrapDoor Attack Hits npm, PyPI, Crates.io — Poisons AI Tools — The Cyber Signal","type":"news_article","archive_url":"http://web.archive.org/web/20260725012727/https://www.thecybersignal.com/trapdoor-npm-pypi-crates-supply-chain-ai-assistant-poisoning-2026/","credibility":2,"archive_timestamp":"2026-07-25T01:27:27+00:00"},{"url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-trapdoor-multi-ecosystem-supply-chain-ai-t/","name":"TrapDoor: Supply Chain Attack Poisons AI Coding Assistants — Cloud Security Alliance Labs","type":"research","archive_url":"http://web.archive.org/web/20260528161437/https://labs.cloudsecurityalliance.org/research/csa-research-note-trapdoor-multi-ecosystem-supply-chain-ai-t/","credibility":2,"archive_timestamp":"2026-05-28T16:14:37+00:00"},{"url":"https://www.crowdfundinsider.com/2026/05/281651-malware-new-trapdoor-supply-chain-attack-reportedly-targets-blockchain-and-crypto-devs-across-multiple-ecosystems/","name":"New TrapDoor Supply Chain Attack Targets Blockchain and Crypto Devs — Crowdfund Insider","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-05-26T18:30:15.796595+00:00","updated_at":"2026-07-25T13:29:14.918501+00:00"}}