TrapDoor / AuditorTrap crypto-stealer campaign across npm, PyPI and crates.io

What happened

On 2026-05-22 at 20:20:18 UTC, Socket observed the first TrapDoor package - eth-security-auditor@0.1.0 on PyPI - and the campaign expanded in waves across npm, PyPI and crates.io through the weekend. By 2026-05-25 it spanned 34+ packages and 384+ versions/artifacts, with some already pulled and others still live. Socket flagged releases in a median of roughly 5–6 minutes (fastest 58 seconds), classifying most as malicious before meaningful adoption.

Xygeni independently tracked an overlapping cluster as AuditorTrap: a 22-package fake "Web3 security guild" catalogue published by ddjidd5640 (a sibling of the ddjidd564 GitHub account Socket tied to the npm/PyPI/crates payloads), branded as the fabricated Crypto Security Guild, Web3 Audit Collective, and DeFi Security Alliance - none of which exist as real organisations; their GitHub orgs are empty shells that exist only to populate the npm "author" hyperlink. Xygeni split the catalogue into two active payload families - Variant A (8 credential-harvesting packages with a postinstall hook plus an MCP-tool scanner.js that runs when an AI agent invokes the package) and Variant B (5 Pinggy-based binary droppers) - plus one dormant tranche.

Rather than typosquatting existing libraries, TrapDoor invents plausible-sounding tools aimed at crypto, DeFi, Solana, AI and security developers. Verified npm releases include prompt-engineering-toolkit, token-usage-tracker, solidity-deploy-guard, defi-threat-scanner, eth-wallet-sentinel, wallet-security-checker, web3-secrets-detector, wallet-backup-verifier, crypto-credential-scanner, defi-env-auditor, chain-key-validator, mnemonic-safety-check, deployment-key-auditor, llm-context-compressor, model-switch-router, async-pipeline-builder, build-scripts-utils, dev-env-bootstrapper, node-setup-helpers, project-init-tools, and workspace-config-loader. PyPI mirrors the theme with eth-security-auditor, defi-risk-scanner, cryptowallet-safety, data-pipeline-check, env-loader-cli, git-config-sync, and solidity-build-guard. Crates.io hosts six Sui/Move-flavoured names (move-project-builder, sui-sdk-build-utils, sui-framework-helpers, sui-move-build-helper, move-analyzer-build, move-compiler-tools) - names that read exactly like the dev helpers, model-routing utilities, Solidity tooling and Sui/Move build helpers their targets routinely install.

Execution is ecosystem-specific. npm packages run a postinstall hook that loads trap-core.js, a ~1,149-line credential harvester and propagation tool; Rust crates abuse build.rs to locate local keystores, XOR-encrypt them with the hard-coded key cargo-build-helper-2026, and exfiltrate to GitHub Gists; PyPI packages execute at import time. Stolen data includes SSH keys, Solana/Sui/Aptos wallet keystores, AWS credentials, GitHub tokens, browser login databases, crypto-wallet extension data, environment variables, API keys and local dev configuration files.

TrapDoor's standout technique poisons AI coding assistants. The attacker plants hidden instructions - concealed with zero-width Unicode characters - inside CLAUDE.md and .cursorrules files, tricking tools like Claude Code and Cursor into running a bogus "security scan" that silently executes the stealer. The campaign is anchored to the GitHub accounts ddjidd564 / ddjidd5640 (payloads served from ddjidd564.github.io/defi-security-best-practices/) and tagged with the internal marker P-2024-001.

• npm versions encoded below were re-verified against the npm registry API on 2026-05-26; every entry is now in a 0.0.1-security holding state, confirming npm pulled the malicious releases.
• PyPI projects in the packages map are confirmed in PyPI admin "quarantined" status (cannot be installed, cannot be modified by maintainer) per PyPI project pages fetched 2026-05-26.
• The six crates.io names are encoded with affectedVersions: [] (match by name only) because Socket's appendix is still rate-limited and crates.io returns 404 for the names - consistent with a yank.
• Socket's underlying article (socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates) and Xygeni's AuditorTrap write-up remain bot-blocked (HTTP 403) at ingest time; verification was driven via npm/PyPI registry APIs, GitHub Security Advisories search, The Hacker News, gbhackers, and Cyber Kendra coverage.

Affected packages (34)

Impact

• Crypto wallet theft: Solana / Sui / Aptos keystores and browser wallet-extension data
• SSH private keys, AWS credentials, GitHub tokens, and .env / API keys exfiltrated to GitHub Gists
• Browser login databases and local development configuration harvested
• AI coding assistants (Claude Code, Cursor) coerced into running the stealer via hidden prompt injection in CLAUDE.md / .cursorrules
• Install-time code execution: npm postinstall, Rust build.rs (cargo build), Python import-time
• Variant B droppers tunnel out over Pinggy, bypassing many corporate egress controls

What to do

1. 1Audit dependency trees for newly-added crypto/DeFi/AI "security" or "build" helper packages added since 2026-05-19 - see the packages map below for the verified name set
2. 2Install with scripts disabled where possible (npm ci --ignore-scripts) and review build.rs in any new Rust dependency before compiling
3. 3Inspect CLAUDE.md, .cursorrules, and other AI-assistant config files for hidden / zero-width Unicode instructions before letting an agent act on them
4. 4Rotate any SSH keys, cloud credentials, GitHub tokens, API keys, and crypto wallet keys exposed on machines that installed a suspect package
5. 5Block egress to ddjidd564.github.io, Pinggy tunnels (*.pinggy.link / *.free.pinggy.link), and audit GitHub Gist exfiltration; the campaign is anchored to the ddjidd564 / ddjidd5640 GitHub accounts and the internal marker P-2024-001
6. 6Distrust the fabricated brands "Crypto Security Guild", "Web3 Audit Collective", "DeFi Security Alliance" - none of these collectives exist as real organisations

References

• TrapDoor crypto stealer supply chain attack hits 34 packages across npm, PyPI, and crates.io

  socket.dev
  Socket
• AuditorTrap: a 22-package fake crypto security guild on npm with two parallel payloads

  xygeni.io
  Xygeni
• TrapDoor supply chain attack spreads credential-stealing malware via npm, PyPI, and CratesIO

  thehackernews.com
  The Hacker News
• Malicious packages on npm, PyPI, and Crates.io steal crypto wallets, SSH keys, and cloud credentials

  cyberkendra.com
  Cyber Kendra
• Hackers compromised 34 packages in npm, PyPI, and crates in new supply chain attack

  cryptika.com
  Cryptika