TrapDoor Malware Targets Crypto Developers Through Fake Open-Source Packages

Socket Security’s researchers have uncovered a large-scale malware campaign targeting crypto and AI developers through malicious open-source packages hosted on npm, PyPI, and Crates.io repositories.

The operation, known as TrapDoor Malware, reportedly relied on fake developer tools and software packages designed to infiltrate developer environments. The malware aimed to steal sensitive credentials linked to crypto projects, cloud infrastructure, and software repositories.

According to Socket Security, attackers distributed 34 malicious packages and more than 384 altered package versions. The packages appeared legitimate to developers searching for blockchain, automation, or AI-related tools.

Supply-chain attack targets developer ecosystems

Socket researchers said the campaign focused on software supply-chain compromise tactics rather than directly targeting retail crypto users.

In practice, attackers attempted to infect the tools developers use during daily workflows. This included software tied to application development, repository management, and blockchain infrastructure deployment.

Once installed, the malware could reportedly harvest browser session data, SSH keys, API credentials, GitHub tokens, and crypto wallet information.

Socket linked the campaign to packages uploaded across widely used developer repositories, including npm for JavaScript projects, PyPI for Python software, and Crates.io for Rust-based applications.

Several reports indicated the malware specifically targeted developers involved in crypto and DeFi projects. Researchers also linked the campaign to Solana, Sui, Aptos, and broader Move-based blockchain ecosystems.

Crypto developers face increasing security pressure

The emergence of TrapDoor Malware highlights how attackers are increasingly shifting away from direct phishing attacks toward developer-focused infiltration strategies.

Crypto companies often rely heavily on open-source software libraries and third-party packages to accelerate development. This improves efficiency, but it also creates opportunities for attackers to insert malicious code into trusted software pipelines.

Socket researchers warned that developers may unintentionally install compromised packages if they closely resemble legitimate tools or contain misleading descriptions. In some cases, attackers reportedly used naming conventions designed to imitate genuine libraries already used by developers.

The reports also noted that compromised developer systems can provide attackers with access to broader infrastructure tied to wallets, cloud services, internal repositories, and deployment systems.

Malware campaign linked to credential theft

Socket researchers said the malware’s primary objective appeared to be credential harvesting and data exfiltration.

Some reports suggested the malicious packages included features capable of collecting environment variables, authentication tokens, browser information, and locally stored wallet credentials. Researchers also noted that the campaign attempted to target AI coding assistants through modified .cursorrules and CLAUDE.md project files.

Those files were reportedly designed to influence development environments and developer workflows. This type of access could potentially allow attackers to move deeper into systems connected to crypto applications or blockchain infrastructure.

Socket urged developers to review installed packages, remove suspicious dependencies, rotate credentials, and monitor repository activity for unusual behavior.

Security researchers have broadly noted a rise in fake job offers, malicious coding assignments, and trojanized developer utilities targeting crypto and AI professionals over the past year.

Separate Android campaign caused confusion

Part of the confusion surrounding the story stems from another malware operation that also used the “TrapDoor” name.

That separate campaign involved 455 malicious Android applications tied to ad fraud operations and fake advertising traffic generation. Researchers clarified that the Android campaign is not directly connected to the developer-focused supply-chain attack affecting crypto and AI ecosystems.

While both operations involve malware distribution, the crypto-focused campaign centered on compromised developer tools and software packages rather than mobile applications.

>>> Read more: North Korean Hackers Use EtherHiding to Hide Crypto Malware

The discovery of TrapDoor Malware adds to growing concerns around open-source software security. The risk is increasing as crypto and AI development ecosystems continue expanding rapidly.

Researchers expect software supply-chain attacks to remain a major cybersecurity threat as developers increasingly depend on third-party packages and automated tooling.