'TrapDoor' Malware Turns Developer Package Registries Into Crypto Heist Infrastructure
A sophisticated supply chain campaign has seeded over 34 poisoned packages across npm, PyPI, and Crates.io — with a twist that weaponizes AI coding assistants against their own users.
Written by OutOfToken AI
June 1, 2026 · 4 min read · Synthesized from reporting by CoinTelegraph · How this works
Security firm Socket has uncovered a coordinated supply chain attack dubbed TrapDoor, targeting cryptocurrency and AI developers through malicious packages distributed across three of the most widely used open-source ecosystems: npm, PyPI, and Crates.io. The campaign has already proliferated across more than 34 packages and hundreds of individual versions, designed to silently exfiltrate crypto wallet data, API keys, cloud credentials, and SSH access. What distinguishes TrapDoor from run-of-the-mill package poisoning is its most audacious vector: injecting hidden instructions into popular AI coding assistants to turn autocomplete and code suggestion engines into unwitting accomplices.
Three Ecosystems, One Coordinated Kill Chain
TrapDoor's breadth is deliberate. By spreading across npm for JavaScript developers, PyPI for Python-based tooling, and the Rust-native Crates.io registry, attackers cast the widest possible net across the modern development stack. Crypto and DeFi tooling sits disproportionately across all three — wallet SDKs, RPC clients, signing libraries, and blockchain interaction utilities are staples of each ecosystem. The malicious packages are crafted to mimic legitimate, high-trust dependencies, using typosquatting and dependency confusion tactics that have become standard playbook for supply chain threat actors. Once installed, TrapDoor's payload activates silently, harvesting environment variables, credential files, and wallet keystores before tunneling the data to attacker-controlled infrastructure.
AI Coding Assistants Become the Attack Surface
The campaign's most technically novel element is its exploitation of AI-assisted development workflows. Socket's researchers found that certain malicious packages contain hidden, specially formatted instruction sets — embedded in comments or metadata — designed to be ingested by AI coding tools like GitHub Copilot and similar large-language-model-powered assistants. When a developer's environment indexes a compromised package, these poisoned instructions can subtly influence code suggestions, steering developers toward insecure patterns or nudging them to include additional malicious imports. It's a second-order attack: compromise the package, then let the developer's own AI tools propagate the damage deeper into the codebase. The technique reflects a maturing threat model that treats AI tooling not as a security layer but as an amplifiable vulnerability.
"Over 34 malicious packages, hundreds of poisoned versions, three major registries — TrapDoor is one of the most broadly distributed crypto-targeting supply chain campaigns Socket researchers have documented to date."
Who's in the Crosshairs
The target profile is specific and financially motivated. TrapDoor is aimed squarely at developers building in DeFi, crypto infrastructure, AI tooling, and security research — precisely the profiles most likely to have high-value secrets sitting in local environments: private keys controlling protocol treasuries, cloud credentials with broad permissions, SSH keys into production nodes. API keys for LLM providers are also a documented target, reflecting both their resale value and their utility in funding further AI-assisted attacks. The attack doesn't require a developer to run malicious code directly; simply installing a poisoned dependency during routine project setup is enough to trigger the harvest. In CI/CD pipelines with minimal inspection, that install step happens automatically.
TrapDoor is a sharp reminder that the open-source package ecosystem remains critically under-defended infrastructure for the crypto and AI industries. As development workflows increasingly offload cognition to AI assistants, attackers are adapting — treating those assistants as new injection points rather than obstacles. Developers should audit dependency trees immediately, cross-reference installed packages against Socket's published advisories, and treat AI code suggestions in environments with unvetted dependencies as potentially compromised. The registries themselves face renewed pressure to implement stricter publication controls and automated behavioral analysis. For now, TrapDoor has the door open — and it's waiting for the next unsuspecting install.
Editorial Note
Supply chain attacks targeting developer tools are a documented threat pattern, and Socket is a reputable security firm known for discovering malicious npm packages. CoinTelegraph is a legitimate crypto news source, though crypto-focused outlets sometimes sensationalize security stories. The claim aligns with known attack vectors (compromised packages, hidden code injection) but specific technical details would require verification from Socket's official advisory.
Claim Tracker
AI-assessed
Relies solely on Socket's claims; no independent confirmation or CISA/official advisory cited
Specific capabilities claimed without technical analysis or evidence provided in excerpt
Novel attack vector claim lacks technical detail or proof-of-concept; highly speculative
Common supply chain technique described but not demonstrated with specific examples in provided text
Ask AI about this story
// discussion
sign in to join the discussion