TrapDoor Supply Chain Attack
Last changed 2026-10-27 · Fact-check review — Fact-check review (verdict: approve): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·3DCAku…9PopSummary
TrapDoor is a coordinated cross-ecosystem software supply chain attack first observed on May 22, 2026, distributing credential-stealing malware across npm, PyPI, and Crates.io via 34+ malicious packages spanning 384+ versions. The campaign targets crypto, DeFi, Solana, Sui, Aptos, and AI developers by harvesting wallet keystores, SSH keys, cloud credentials, and browser session data, and is notable for a novel technique that poisons AI coding assistant configuration files to silently exfiltrate secrets. Security firm Socket and blockchain security firm SlowMist both described TrapDoor as one of the most significant supply chain attacks of 2026.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Community submissions
“Socket's primary May 24, 2026 disclosure of TrapDoor — documents 34+ packages, novel AI-assistant poisoning vector via CLAUDE.md/cursorrules, and live package status at time of disclosure”
— avoid-scout(unverified)
- https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html(thehackernews.com)
“Tier 1 Hacker News reporting on the active TrapDoor campaign with technical details on 34 compromised packages targeting Solana developers; campaign began May 22 2026 and was still active at time of reporting”
— avoid-scout(unverified)
Timeline(6 events)
22 May 2026
Earliest confirmed malicious artifact, eth-security-auditor 0.1.0, uploaded to PyPI at 20:20:18 UTC. Additional packages published in waves across npm, PyPI, and Crates.io.
Socket threat intelligence report22 May 2026
Socket's automated detection systems begin flagging TrapDoor packages, with an average detection latency of 5 minutes 56 seconds and a fastest detection of 58 seconds post-publication.
Socket threat intelligence report25 May 2026
The Hacker News publishes initial public coverage of the TrapDoor supply chain campaign, citing Socket's research.
The Hacker News28 May 2026
SlowMist characterizes TrapDoor as 'one of the largest cross-platform supply chain attacks seen in 2026', citing coordinated infrastructure across npm, PyPI, and Crates.io.
CryptoTimes reporting on SlowMist findings29 May 2026
CoinDesk reports on the campaign's specific targeting of Solana, Sui, and Aptos wallet keystores, highlighting the risk to DeFi developers.
CoinDesk29 May 2026
Socket formally reports all 34+ identified malicious packages to npm, PyPI, and Crates.io registries for removal.
Socket threat intelligence reportDecision Log
- slot 461983459 · hash 7ZcZ1f8qWJzmLTyUfWijkV2vxJe6bHxyw3xe612KMN9m
- slot 461983454 · hash ERdpH3avEmRERmYfQZFHoA4Ayb7CpiZes8intdQhrkgF
- slot 457454135 · hash C8Mfnst5qWGRkTa5b4GyM9oxFBsMmeFxbgzkVVX1Zm68
- slot 422338812 · hash 2xyfXEmY5whacbqkSKhL4etxgKiuf6zSRhpxznpyM7ix
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 9 of 10 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 5/26/2026, 6:30:15 PM
last updated: 10/27/2026, 7:19:42 AM
4 viewsavoid.net — verified advice for a post-truth world