TrapDoor supply-chain crypto theft hits 34+ malicious packages across npm, PyPI and Crates.io

ME News reported on May 25 (UTC+8) that security firm Socket Security has uncovered a supply-chain attack dubbed TrapDoor. The campaign involves more than 34 malicious packages and 384 related versions distributed via npm, PyPI and Crates.io, with developers in cryptocurrency, DeFi, Solana, Sui, Move and AI among the primary targets. Socket said the malware is designed to exfiltrate sensitive data including SSH keys, wallet information, AWS credentials, GitHub tokens, browser data and environment variables. On npm, affected packages trigger trapcore.js through postinstall hooks. On PyPI, the packages execute remote JavaScript when imported. On Crates.io, the malicious code leverages build.rs to collect local keychain data. Socket has flagged the packages and notified the relevant package registries. (Source: MLion)