TrapDoor attack targets crypto wallets, AWS keys and GitHub tokens

• The malware spread through npm, PyPI, and Rust packages in coordinated waves.
• It steals crypto wallets, SSH keys, and cloud developer credentials.
• AI coding tools were also targeted through malicious config files.

A coordinated malware campaign known as TrapDoor has hit software ecosystems widely used by crypto and blockchain developers.

Security researchers identified dozens of malicious packages spread across major open-source repositories, all designed to steal sensitive developer data such as wallet keys, cloud credentials, and source code access tokens.

Instead of a single malicious upload, attackers deployed multiple packages in waves using different accounts.

This approach made the activity harder to detect at the early stages and allowed the malware to blend into routine dependency updates.

Coordinated attack across major developer ecosystems

The TrapDoor operation affected at least three major package ecosystems: npm, PyPI, and Crates.io.

Together, researchers identified more than 30 malicious packages and over 300 affected versions distributed within a short window.<...