The TrapDoor supply-chain campaign is another warning that attackers are no longer targeting only one package ecosystem at a time. According to the report, the campaign spans npm, PyPI, and Crates.io, with more than 34 malicious packages across 384+ versions, targeting developers in crypto, DeFi, Solana, and AI communities. That is not a random package incident. That is coordinated developer-environment hunting, because apparently attackers have discovered that developers keep credentials scattered around like confetti at a breach parade.

The malware is designed to steal developer secrets, crypto wallets, SSH keys, cloud credentials, browser data, and environment variables. Several npm packages deploy a shared payload named trap-core.js, which scans for credentials, validates AWS and GitHub tokens, attempts SSH-based lateral movement, and establishes persistence using .cursorrules, CLAUDE.md, Git hooks, shell hooks, systemd, cron, and SSH. 

What makes this campaign especially dangerous is its cross-ecosystem execution model. npm packages use postinstall hooks, PyPI packages execute payloads during import and fetch remote JavaScript from attacker-controlled infrastructure, while Rust crates abuse build.rs scripts and exfiltrate local keystore data to GitHub Gists. This shows attackers are adapting to the unique trust and execution paths of each ecosystem instead of relying on one generic technique. 

The AI angle is also concerning. The campaign reportedly plants .cursorrules and CLAUDE.md files containing hidden instructions intended to manipulate AI coding assistants into running “security scans” that actually discover and exfiltrate secrets. This is a new kind of developer workflow abuse where attackers are not just poisoning packages, but also trying to poison the instructions consumed by AI tools. 

Organizations should review recent npm, PyPI, and Rust dependencies, inspect build logs for unusual postinstall/import/build script behavior, block known malicious packages, rotate potentially exposed GitHub, AWS, SSH, CI/CD, crypto wallet, and cloud credentials, and monitor outbound traffic to suspicious GitHub Pages, Gists, or unknown endpoints. Development teams should also restrict package install sources, review dependency changes, isolate CI/CD secrets, and treat AI assistant instruction files as security-relevant content. 

The broader lesson is simple: the software supply chain now includes packages, build scripts, developer machines, AI coding tools, CI/CD runners, and the secrets sitting across all of them. If attackers compromise the developer workflow, they do not need to attack production first. They can let the build process carry them there, neatly wrapped in trusted automation.

A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stealing malware. The campaign, codenamed TrapDoor, spans more than 34 malicious packages across over 384 versions. The earliest activity was recorded on May 22, 2026, at 8:20 p.m. UTC, with new packages published to the ecosystems in waves from a cluster of

Source: TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO via The Hacker News — published 25 May 2026.