TrapDoor: 34+ Malicious Packages Hit npm, PyPI, and Crates.io in Coordinated Supply Chain Attack

34+ malicious packages. 384+ versions. Three package ecosystems hit in coordinated waves. The TrapDoor supply chain campaign, first detected on May 22, 2026, is one of the most ambitious cross-ecosystem attacks against developer infrastructure this year — and it is still actively deploying.

What Happened

Starting at 8:20 PM UTC on May 22, 2026, a threat actor began publishing malicious packages across three of the world's largest open-source registries: npm (JavaScript/Node.js), PyPI (Python), and Crates.io (Rust). The campaign, tracked as TrapDoor by researchers at Socket, has sofar compromised at least 34 distinct packages spanning more than 384 published versions and artifacts.

The targets were not random. The malicious packages specifically targeted developer tooling in the cryptocurrency, DeFi, Solana, and AI/ML ecosystems — environments where a single stolen credential can drain wallets worth millions or inject backdoors into production pipelines.

According to Socket's analysis, the campaign is still active as of May 26, with new packages continuing to appear across all three registries. SOC Radar confirmed the credential-stealing payload targets environment variables, API keys, wallet seeds, and browser-stored tokens.

Technical Analysis: How TrapDoor Works

What makes TrapDoor technically notable is its post-publication payload mutation — a technique that most supply chain attacks skip entirely.

On PyPI, the malicious packages contain code that auto-executes on import. Instead of embedding a static payload, the package immediately fetches a remote JavaScript payload from an attacker-controlled GitHub Pages domain using node -e. As ByteIota documented, this lets the attacker update the malware's behavior after publication without pushing a new package version — a detection-evasion step that blinds static analysis tools and most registry-level scanners.

On npm and Crates.io, the packages use similar typosquatting and dependency-confusion strategies, masquerading as legitimate utility libraries for blockchain interaction, AI model tooling, and Solana development. Once installed, the payload:

• Harvests environment variables (.env files, shell profiles)
• Extracts credentials from config files for AWS, GCP, Docker, Kubernetes
• Scans browser profiles for stored session tokens and crypto wallet extensions
• Exfiltrates collected data to attacker-controlled endpoints via HTTPS

Phoenix Security noted the campaign also exhibits characteristics of AI poisoning — several malicious packages target AI/ML pipelines where a compromised dependency could corrupt model weights or training data, not just steal credentials.

Impact

The scope is difficult to quantify precisely because the attack is ongoing, but the known numbers are significant:

• 34+ confirmed malicious packages across three ecosystems (some counts reach 36)
• 384+ published versions and artifacts
• Three of the world's largest package registries (npm, PyPI, Crates.io)
• Four high-value target sectors: crypto, DeFi, Solana blockchain, AI/ML
• Earliest confirmed activity: May 22, 2026 at 8:20 PM UTC — and still active 4 days later

As CyberSecurityNews reported, the coordinated nature — hitting three ecosystems simultaneously with the same payload infrastructure — suggests a well-resourced threat actor, not an opportunistic script Kiddie. The Hacker News confirmed the campaign spans at least 384 related versions.

How to Protect Yourself

If you are a developer working with npm, PyPI, or Crates.io — especially in crypto, AI/ML, or blockchain — take these steps immediately:

1. Audit your dependencies. Check package.json, requirements.txt, and Cargo.toml for packages you don't recognize or that were recently added. Cross-reference against Socket's and SOC Radar's published IOCs.
2. Pin your dependencies using lockfiles (package-lock.json, Pipfile.lock, Cargo.lock) and verify checksums against known-good versions.
3. Scan for post-install scripts. Any npm package with a postinstall hook that reaches out to external domains during a node -e call should be treated as suspicious. PyPI packages that execute network calls on import are an immediate red flag.
4. Rotate credentials immediately if you have installed any previously unknown packages in the last two weeks. Assume environment variables, API keys, and wallet seeds are compromised.
5. Enable 2FA on package publishing. As of this week, npm now requires 2FA for publishing — but this only protects the supply side. On the consumption side, use tools like Socket, Snyk, or Dependabot to catch malicious packages before they enter your environment.
6. Monitor outbound network traffic from CI/CD pipelines and developer workstations. The TrapDoor payload communicates over HTTPS to attacker infrastructure — network-level detection can catch what static analysis misses.

The Bigger Picture

TrapDoor is the latest in an accelerating wave of supply chain attacks targeting open-source ecosystems. It follows the Mini Shai-Hulud worm that compromised TanStack and Mistral AI packages earlier this month, and the broader trend of threat actors treating package registries as primary distribution channels for malware.

The cross-ecosystem nature of TrapDoor — hitting JavaScript, Python, and Rust simultaneously — signals that attackers are no longer targeting a single language community. If your organization depends on open-source software (and whose doesn't?), supply chain security is no longer optional. It is infrastructure.