TrapDoor Malware Hijacks AI Coding Tools to Steal Crypto Wallets and Developer Credentials

TrapDoor Malware Launches Cross-Ecosystem Attack on Developer Communities

A coordinated supply chain attack campaign dubbed TrapDoor malware has emerged across multiple developer ecosystems, distributing credential-stealing malware through malicious packages on npm, PyPI, and Crates.io 1

1

. Developer platform Socket detected the campaign on Friday, revealing that it spans more than 34 malicious packages across over 384 versions, with the earliest activity recorded on May 22, 2026, at 8:20 p.m. UTC 1

1

. The operation specifically targets crypto and AI developers working in crypto, DeFi, Solana, and AI communities, with attackers repeatedly pushing new releases across ecosystems in waves from a cluster of accounts in quick succession 1

1

2

2

.

Stealing Sensitive Information Through Multiple Attack Vectors

The malicious packages are engineered to extract developer secrets, crypto wallet information, SSH keys, cloud credentials, browser data, and environment variables from infected systems 1

1

. Socket chief technology officer Ahmad Nassri confirmed that the malware targets popular crypto wallets, including Coinbase, Binance, Solana, Sui, Aptos, and MetaMask, in addition to the Brave internet browser 2

2

. Several npm packages deploy a shared payload called trap-core.js that scans for credentials, validates AWS and GitHub tokens, attempts SSH-based lateral movement, and plants persistence through .cursorrules, CLAUDE.md, Git hooks, shell hooks, systemd, cron, and SSH 1

1

. The operation is notable for its diverse delivery paths, using postinstall hooks, remote JavaScript payloads executed during package imports, and malicious build.rs scripts to target Sui and Move developers 1

1

.

Novel Technique to Hijack AI Coding Assistants

An unusual aspect of the campaign involves implanting .cursorrules and CLAUDE.md files containing hidden instructions designed to trick AI coding assistants like Claude and Cursor into running a "security scan" that results in secret discovery and exfiltration 1

1

2

2

. The threat actor has been opening GitHub pull requests across popular AI and developer projects, including browser-use/browser-use, langchain-ai/langchain, and langflow-ai/langflow, testing whether AI-related project files can be introduced through regular open-source contribution workflows 1

1

. This approach extends the attack beyond pushing malicious packages to open-source ecosystems, potentially causing AI coding tools to parse those hidden instructions and apply them automatically.

Sophisticated Multi-Language Execution Strategies

The campaign demonstrates technical sophistication through ecosystem-specific execution paths tailored to each platform. The npm packages run a JavaScript payload that scans for credentials, validates stolen credentials using AWS and GitHub API calls, and creates persistence on the host using cron jobs, systemd services, Git hooks, and moves across the network via SSH 1

1

. The Rust crates search for local keystores, encrypt the data using a hardcoded XOR key, and exfiltrate it to GitHub Gists, using a build script to trigger malicious code execution 1

1

. The Python packages are designed for auto-execution on import, downloading JavaScript from an attacker-controlled GitHub Pages domain and running it using node -e, allowing the attacker to update behavior without publishing a new PyPI release 1

1

.

AI-Assisted Iteration and Evolving Threat Landscape

Socket's analysis suggests the attack shows signs of AI-assisted iteration, with broad security-themed scaffolding, generic lure repositories, prompt-injection documentation, and partially implemented extraction concepts mixed with working malware components 2

2

. The malicious package names are crafted to appear relevant to crypto development, AI tooling, local environment setup, and security workflows, giving the campaign broad reach across adjacent developer communities where crypto wallets, cloud credentials, GitHub tokens, and SSH keys are likely to be present 1

1

2

2

. The findings demonstrate how threat actors are increasingly targeting developer workflows, aiming to steal a wide range of information that could enable them to burrow deeper into target environments for follow-on attacks, representing a significant evolution in the threat landscape facing modern development teams.