v1 → v2
Scores
trust_score0 → 0
severity_base— → —
score_modifier-3.36 → -3.36
Sections
Campaign Overview
unchanged
Malicious Packages
unchanged
Technical Execution and Payload Mechanics
unchanged
Data Exfiltration Targets
unchanged
AI Coding Assistant Poisoning
unchanged
Infrastructure and Attribution
unchanged
Detection and Registry Response
unchanged
Affected Developer Communities and Risk Profile
unchanged
Timeline events
No timeline changes.
Accepted submissions
- removedurlincriminating
{"url":"https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html","kind":"url"}- removedurlincriminating
{"url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates","kind":"url"}Each version is bound to the decision event that created it. Verify the chain anchor for either via the audit log.
v1 hash: C8Mfnst5qWGRkTa5b4GyM9oxFBsMmeFxbgzkVVX1Zm68
v2 hash: 22e75f507be8c575992fde9f21bb0a8e71fa2840efc1539d3b200b0d1268d762