TrapDoor: Malicious npm, PyPI, Crates.io Packages Target Developer Secrets & AI Tooling

Researchers identified a coordinated supply chain malware campaign named TrapDoor, involving waves of malicious packages across npm, PyPI, and Crates.io. Public reports tie the activity to credential theft and environment compromise, with an emphasis on developer secrets, crypto assets, and persistence on workstations and build environments. A notable twist is an “AI assistant poisoning” angle, where the malware reportedly modifies or creates project files that AI coding tools may ingest as instructions.

This post breaks down what the TrapDoor campaign is, how it executes, what defenders should look for, and what actions to take now.

What Is the TrapDoor Supply Chain Attack?

TrapDoor is a cross-ecosystem package poisoning operation in which attackers uploaded dozens of malicious open-source packages to popular developer registries, then released hundreds of affected versions in quick waves. Public reporting puts the scale at 34+ packages and 380+ affected versions.

The objective appears straightforward: land on developer machines via normal dependency installation flows, then steal valuable secrets and establish footholds that survive beyond a single install event.

Which Ecosystems and Developer Communities Were Targeted?

The campaign spans three major registries:

• npm (JavaScript/Node.js)
• PyPI (Python)
• Crates.io (Rust/Cargo)

The operators focused on developers involved in crypto/DeFi and Solana-related work, as well as AI-adjacent communities. That targeting matches the data the malware reportedly hunts for, including wallet-related information and tokens that could enable repo access or cloud pivoting.

How Did TrapDoor Execute During Install or Build?

TrapDoor relies on execution points that many teams implicitly trust because they occur during dependency installation or builds.

Rust: build.rs as a build-time execution trigger

For Rust, reporting highlights abuse of build.rs scripts. Because build.rs executes as part of the build process for a crate, it provides a path to run attacker-controlled code during compilation, including in CI environments if the dependency is pulled there.

npm: shared payload behavior

Some malicious npm packages reportedly drop or invoke a shared JavaScript payload named trap-core.js. This suggests reuse across multiple published packages and a modular design where the initial package acts as a loader.

What Post-Install Behaviors Were Reported?

Once executed, reported behaviors align with an infostealer plus persistence toolkit aimed at developer environments:

• Secret harvesting: collecting environment variables, cloud credentials, GitHub tokens, SSH keys, browser data, and crypto-related artifacts.
• Token validation: attempts to validate AWS and GitHub tokens, which can help attackers prioritize high-value credentials and reduce noisy exfiltration.
• SSH-based movement: SSH-based lateral movement attempts imply that the operator may try to expand access beyond the initially infected host.
• Persistence mechanisms: attempts to persist via multiple common paths, including:
• .cursorrules
• CLAUDE.md
• Git hooks
• shell hooks
• systemd
• cron
• SSH-related mechanisms

For defenders, the key point is that this goes beyond install-time theft. The reported persistence options point to an intent to stay on developer machines long enough to capture new secrets as they are created.

What Does “AI Assistant Poisoning” Mean in This Incident?

One of the more operationally relevant details is the reported tampering with AI workflow and instruction files that some developer tools read automatically. Reports highlight the creation or modification of files such as:

• .cursorrules
• CLAUDE.md

The risk is not that the AI model itself is infected. The risk is that developer tooling may ingest attacker-authored instructions as trusted project context. In a real workflow, that could influence code generation, recommend unsafe commands, redirect dependency choices, or encourage developers to paste secrets or run scripts. Even small instruction changes can have impact if they persist in a repo or template used across projects.

What Should Defenders Do Now to Contain TrapDoor Risk?

Because public reporting does not establish a definitive victim list or quantified losses, response should focus on scoping, eradication, and secret hygiene.

1) Hunt for suspicious packages and versions introduced in late May 2026

• Inventory dependencies across npm, PyPI, and Cargo.
• Pay special attention to new or recently updated dependencies added around May 22–25, 2026, when the publication waves were first observed.

2) Check for AI instruction file tampering in repos and developer endpoints

• Review repositories and home directories for unexpected or recently modified .cursorrules and CLAUDE.md files.
• Treat unexplained changes as security-impacting, not just documentation drift, since these files can steer tool behavior.

3) Review persistence locations commonly abused in developer environments

Prioritize review of:

• Git hooks (project-level and global)
• shell init files and hooks
• cron entries
• systemd user services
• SSH configurations and keys

If you find persistence artifacts, assume credential access likely occurred on that endpoint.

4) Rotate exposed secrets aggressively if installation is suspected

Even without confirmed exfiltration, the reported functionality supports theft of high-impact credentials. Consider rotating:

• GitHub tokens
• cloud access keys (AWS and others used in the environment)
• SSH keys
• API keys accessible from impacted hosts and CI runners

5) Reduce build-time risk for Rust and CI pipelines

Given the build.rs execution vector noted in reporting:

• Run builds in ephemeral, sandboxed CI workers
• Limit outbound network access during builds where feasible
• Treat unexpected build-script behavior as a security signal, not a build quirk

Strengthen Supply Chain Risk Monitoring With SOCRadar

Software and vendor ecosystems can introduce risk long before a direct compromise is detected. SOCRadar Supply Chain Intelligence helps organizations monitor supplier-related threats, assess exposure across third-party relationships, and stay aware of incidents that may affect critical partners or service providers.

For teams trying to reduce blind spots beyond their own perimeter, this kind of visibility can support earlier action and better prioritization.