TrapDoor Malware Hits Crypto Devs via npm, PyPI and AI Assistant Tricks

TrapDoor is a supply-chain malware campaign targeting crypto developers through the software packages they trust most, and it’s doing it with a nasty twist: hidden instructions aimed at AI coding assistants like Claude and Cursor.

• TrapDoor targeted crypto, DeFi, AI, and security developers
• Spread through npm, PyPI, and Crates
• Used fake utility packages to hunt for secrets quietly
• Targeted wallet data, SSH keys, cloud creds, GitHub tokens, API keys
• Socket says the operation involved 34 malicious packages and 384 versions

Developer security platform Socket says it detected the campaign on Friday and published its findings on Sunday, but by then the scale was already clear. TrapDoor had spread through dozens of malicious packages across npm, PyPI, and Crates, the big dependency repositories used by JavaScript, Python, and Rust developers. For anyone who still thinks package registries are harmless code malls, here’s the reminder: they can also be a malware delivery service with a clean logo.

Supply-chain malware means the bad code isn’t pushed directly at one victim. Instead, it’s hidden inside third-party software libraries and tools that developers download and install as part of normal work. One poisoned package can infect many machines, many projects, and eventually many downstream users. That’s what makes this class of attack so efficient and so annoying. Cybercriminals don’t need to kick down the front door when they can get invited in through the side gate with a fake badge.

The packages were designed to look boring and useful, which is exactly why they’re dangerous. Some pretended to be setup tools, developer helpers, prompt engineering packages, or build utilities for Solidity and Sui. That means they were aimed at people who might install them in a rush and assume they’re legitimate because the name sounds vaguely familiar and the workflow is on fire. Classic supply-chain shenanigans: weaponize trust, then cash out.

Once installed, TrapDoor wasn’t just trying to grab a few passwords and call it a day. Socket says the attackers embedded hidden instructions inside the packages to manipulate AI coding assistants.

“The attackers behind TrapDoor went after more than wallets and passwords — they embedded hidden instructions inside packages designed to manipulate AI coding assistants.”

That’s the grimly interesting part. The malware tried to trick tools like Claude and Cursor into running what looked like routine security scans, but those scans were set up to quietly discover and send out secrets stored on a developer’s machine. In plain English: the package wasn’t only malware; it was malware trying to use AI as an unwitting accomplice.

Socket put it this way:

“The goal was to trick tools like Claude and Cursor into running what appeared to be routine security scans, which would then quietly discover and send out secrets stored on a developer’s machine.”

The loot list is the sort of thing that can ruin a career, a startup, or an entire codebase. TrapDoor targeted wallet data, SSH keys, cloud credentials, GitHub tokens, browser extension data, and API keys. For crypto developers, that’s not just sensitive data; it’s the keys to signing, deploying, accessing infrastructure, and often moving real money. Once those credentials are gone, the blast radius can get ugly fast.

The malware also cast a wide net across the crypto stack and its adjacent ecosystem, with references tied to Coinbase, Binance, Solana, Sui, Aptos, MetaMask, and Brave. That mix matters. It shows the campaign wasn’t just aimed at one wallet or one chain, but at the broader developer environments where wallet integrations, browser extensions, cloud services, and deployment pipelines all collide.

Socket says the operation had already produced 34 malicious packages and 384 related versions before it was uncovered. That’s not random spam. That’s industrial-scale dependency poisoning. Package managers are supposed to make development easier by letting teams reuse code and tools. In the wrong hands, they become a fast lane for compromise. Trusting third-party code blindly is not “move fast and build things” behavior; it’s how you end up turning your repo into a crime scene.

Socket CTO Ahmad Nassri added another sharp wrinkle: GitHub activity tied to the campaign showed signs of AI-assisted development. If that’s accurate, it suggests the attackers may have used AI to speed up package creation, obfuscation, or campaign management. That matters because it could lower the cost of producing large-scale malware campaigns and make them harder to spot. Bad actors are absolutely learning to use the same tools everyone else is using, because of course they are.

The timing doesn’t help the mood either. GitHub reported unauthorized access to internal repositories on May 20, just days before TrapDoor was detected. Socket did not say the two incidents were directly connected, so nobody should pretend that link is confirmed. Still, the overlap is hard to ignore. Whether related or not, it’s a blunt reminder that developer environments are juicy targets precisely because they concentrate access, secrets, and trust in one place.

That’s especially true in crypto and DeFi, where a developer’s machine may hold wallet integrations, signing tools, deployment credentials, cloud access, and tokens for internal systems. Compromise the builder, and you may not need to touch the end user until later. Attack the source, and the downstream damage can show up as drained wallets, malicious updates, stolen infrastructure, or quietly poisoned dependencies feeding into other projects.

It also exposes an uncomfortable truth for the industry: decentralization at the protocol level does not magically solve operational security at the human level. Bitcoin can be sound money. Ethereum can run smart contracts. Other chains can fill their own niches. None of that matters much if the developer laptop is leaking secrets because someone installed a sketchy package and let an AI assistant wander through the wreckage. The blockchain may be robust; the workflow around it often isn’t.

For builders, the obvious lesson is to treat package installs like a security decision, not a reflex. Verify publishers. Audit dependencies. Keep production secrets out of dev environments where possible. Use hardware wallets, separate credentials, and proper secret management. Most importantly, don’t let convenience become a fancy word for negligence. Malware thrives on speed, laziness, and “it looked fine at the time.”

For everyone else, the broader takeaway is simple: supply-chain attacks are not some abstract enterprise IT problem. In crypto, they can translate directly into wallet theft, account compromise, and codebase sabotage. This is the dark side of open ecosystems: the same openness that powers innovation also gives attackers a big, greasy lever if the guardrails are weak.

• What is TrapDoor?
  TrapDoor is a malicious supply-chain campaign that spread through software packages and tried to steal crypto and developer secrets.
• Which ecosystems were targeted?
  The attack hit npm, PyPI, and Crates, which serve JavaScript, Python, and Rust developers.
• What did the malware try to steal?
  It targeted wallet data, SSH keys, cloud credentials, GitHub tokens, browser extension data, and API keys.
• Why is this especially dangerous for crypto users?
  Stolen keys and credentials can lead directly to wallet drains, account takeovers, codebase compromise, and infrastructure breaches.
• How did AI come into play?
  The malware was designed to manipulate AI coding assistants like Claude and Cursor into running fake security scans that would expose secrets.
• Why do developers matter as targets?
  Developers often control the keys and credentials that unlock wallets, deploy smart contracts, and manage production systems.
• Is this likely a coordinated attack?
  Socket describes TrapDoor as a coordinated campaign aimed at crypto, DeFi, AI, and security developers.
• What does this say about crypto security?
  It shows the weakest link is often not the blockchain itself, but the software supply chain and the human workflow around it.
• Could ordinary users be affected?
  Yes. If developers are compromised, end users can be exposed through stolen funds, malicious updates, or poisoned dependencies.
• What’s the main takeaway?
  Blind trust in packages is a terrible habit, and in crypto it can get expensive fast. One bad dependency can become a wallet-emptying disaster before anyone notices.