We explain what TrapDoor is and whether ordinary crypto users should worry or take action.
Socket Security has uncovered a large-scale campaign called TrapDoor that targets crypto, DeFi, AI, and security developers through malicious packages in popular repositories. Attackers have already distributed more than 34 packages and over 384 versions of them.
Hot topic: Bitcoin Price Recovers, But Analyst Still Sees Risk of Drop Into $60Ks
How TrapDoor Attacks Crypto Developers
The campaign affects npm, PyPI, and Crates.io, the primary library repositories for JavaScript, Python, and Rust. The packages disguise themselves as development tools such as crypto auditors, Sui and Move helpers, DeFi scanners, and AI utilities. Once installed, they steal SSH keys, wallet data, AWS credentials, GitHub tokens, and information from browsers.
Special attention is given to popular crypto wallets, including Coinbase, Binance, Solana, Sui, Aptos, and MetaMask. Additionally, the malware injects hidden instructions to intercept AI coding assistants such as Claude and Cursor, tricking them into running “security checks” and sending discovered secrets to attackers.
Read more: Squid Says Third-Party Safe Module Exploit Drained $3.2M From 86 Wallets
Reaction and Consequences
GitHub has already been used to distribute the packages. Socket analysts note signs of AI-assisted malicious code creation: rapid iterations, generic descriptions, and partially completed modules. The campaign has low volume but high targeting precision—it strikes environments where high-value data is stored.
Experts emphasize that such attacks are becoming increasingly common. Developers are advised to check packages before installation, use isolated environments, and regularly update their tools.
Amid growing interest in AI and crypto infrastructure, TrapDoor demonstrates new supply chain risks. It is still unknown how many developers have already been affected, but specialists warn that the damage could be significant.
Learn more: Why On-Chain Credit Markets Are Becoming a Major Trend in 2026
