Cybersecurity company Socket has issued a warning about a new malware campaign called TrapDoor. The attack specifically targets software developers working in the cryptocurrency, decentralized finance (DeFi), and artificial intelligence (AI) industries. According to a Socket blog post, attackers upload malicious packages to widely used developer libraries such as npm and PyPI.
How TrapDoor infects
The bad actors behind TrapDoor embed malicious code into seemingly legitimate packages. Developers who unknowingly download and install these packages in their projects become infected. Once active, the malware functions as an information stealer. It extracts sensitive data from compromised systems. Primary targets include cryptocurrency wallet extensions such as MetaMask and Phantom, as well as SSH keys and GitHub authentication tokens. By capturing these credentials, attackers can gain unauthorized access to digital assets and source code repositories, which can lead to asset theft.
Why it matters for crypto and AI developers
Developers in the crypto, DeFi, and AI industries often rely on open source packages to quickly build applications. The npm and PyPI ecosystems are particularly attractive to attackers because they are widely used and often trusted without extensive security oversight. TrapDoor exploits this trust, turning routine dependency installations into a serious security risk. Theft of MetaMask or Phantom wallet keys could result in loss of cryptocurrency holdings. Similarly, compromised SSH keys and GitHub tokens could allow attackers to inject more malicious code into production environments or steal intellectual property. This attack highlights a growing trend in software supply chain threats. Malicious packages targeting developers are becoming more and more sophisticated. TrapDoor reminds that even trusted repositories can host dangerous code. For organizations that rely on blockchain or AI platforms, a single infected dependency can result in significant financial and reputational damage.
What developers should do
Socket advises developers to exercise caution when adding new dependencies to their projects. Security experts recommend checking package integrity, using package lock files, and using automated security tools that look for suspicious behavior. Additionally, developers should consider using hardware wallets to store cryptocurrency keys and enable multi-factor authentication on GitHub accounts. The TrapDoor malware campaign is a targeted and scalable threat. By exploiting trust in open source repositories, attackers steal sensitive credentials, which can lead to financial losses and data breaches. Developers and organizations must remain vigilant and adopt proactive security measures to protect their workflows and assets.
