# TrapDoor / AuditorTrap crypto-stealer campaign across npm, PyPI and crates.io

> Starting 2026-05-22 the **TrapDoor** / **AuditorTrap** campaign pushed 34+ malicious packages (384+ versions) across npm, PyPI and crates.io posing as crypto/DeFi/AI dev tools and fake "security guild" branding. Payloads steal SSH keys, cloud credentials and Solana/Sui/Aptos wallets, and hide zero-width-Unicode prompt injection in `CLAUDE.md`/`.cursorrules` to trick Claude Code and Cursor into running the stealer.

- Published: 2026-05-22
- Last updated: 2026-05-26
- Severity: critical
- Kind: Malicious package - A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
- Ecosystems: crates.io, npm, PyPI
- Scope: 34 packages, 404 compromised versions
- Tags: infostealer, credential-theft, crypto-wallet-drain, prompt-injection, obfuscation, cdn-supply-chain
- Also known as: TrapDoor, AuditorTrap, Crypto Security Guild, Web3 Audit Collective, DeFi Security Alliance
- Detected by: Socket, Xygeni
- Incident ID: multi-2026-05-22-trapdoor-crypto-stealer

## Affected packages (34)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [async-pipeline-builder](https://dependencywatch.io/package/npm/async-pipeline-builder) | npm | 1.0.0, 1.0.1, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1 |
| [build-scripts-utils](https://dependencywatch.io/package/npm/build-scripts-utils) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1 |
| [chain-key-validator](https://dependencywatch.io/package/npm/chain-key-validator) | npm | 0.2.1, 0.2.2, 0.2.3, 0.2.4, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 4.0.0 |
| [crypto-credential-scanner](https://dependencywatch.io/package/npm/crypto-credential-scanner) | npm | 2.0.0, 2.0.1, 2.0.2, 2.0.3, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 4.0.0 |
| [cryptowallet-safety](https://dependencywatch.io/package/pypi/cryptowallet-safety) | PyPI |  |
| [data-pipeline-check](https://dependencywatch.io/package/pypi/data-pipeline-check) | PyPI | 0.1.1 |
| [defi-env-auditor](https://dependencywatch.io/package/npm/defi-env-auditor) | npm | 0.3.0, 0.3.1, 0.3.2, 0.3.3, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.4.9, 4.0.0 |
| [defi-risk-scanner](https://dependencywatch.io/package/pypi/defi-risk-scanner) | PyPI | 0.1.0 |
| [defi-threat-scanner](https://dependencywatch.io/package/npm/defi-threat-scanner) | npm | 2.1.0, 2.1.1, 2.1.2, 2.1.3, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 4.0.0 |
| [deployment-key-auditor](https://dependencywatch.io/package/npm/deployment-key-auditor) | npm | 0.7.1, 0.7.2, 0.7.3, 0.7.4, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.8.6, 1.8.7, 1.8.8, 1.8.9, 4.0.0 |
| [dev-env-bootstrapper](https://dependencywatch.io/package/npm/dev-env-bootstrapper) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.2 |
| [env-loader-cli](https://dependencywatch.io/package/pypi/env-loader-cli) | PyPI | 0.1.1 |
| [eth-security-auditor](https://dependencywatch.io/package/pypi/eth-security-auditor) | PyPI | 0.1.0 |
| [eth-wallet-sentinel](https://dependencywatch.io/package/npm/eth-wallet-sentinel) | npm | 1.0.7, 1.0.8, 1.0.9, 1.0.10, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 4.0.0 |
| [git-config-sync](https://dependencywatch.io/package/pypi/git-config-sync) | PyPI | 0.1.1 |
| [llm-context-compressor](https://dependencywatch.io/package/npm/llm-context-compressor) | npm | 1.0.0, 1.0.1, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1 |
| [mnemonic-safety-check](https://dependencywatch.io/package/npm/mnemonic-safety-check) | npm | 0.5.0, 0.5.1, 0.5.2, 0.5.3, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 4.0.0 |
| [model-switch-router](https://dependencywatch.io/package/npm/model-switch-router) | npm | 1.0.0, 1.0.1, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1 |
| [move-analyzer-build](https://dependencywatch.io/package/crates/move-analyzer-build) | crates.io |  |
| [move-compiler-tools](https://dependencywatch.io/package/crates/move-compiler-tools) | crates.io |  |
| [move-project-builder](https://dependencywatch.io/package/crates/move-project-builder) | crates.io |  |
| [node-setup-helpers](https://dependencywatch.io/package/npm/node-setup-helpers) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1 |
| [project-init-tools](https://dependencywatch.io/package/npm/project-init-tools) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1 |
| [prompt-engineering-toolkit](https://dependencywatch.io/package/npm/prompt-engineering-toolkit) | npm | 1.0.0, 1.0.1, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1 |
| [solidity-build-guard](https://dependencywatch.io/package/pypi/solidity-build-guard) | PyPI |  |
| [solidity-deploy-guard](https://dependencywatch.io/package/npm/solidity-deploy-guard) | npm | 0.4.2, 0.4.3, 0.4.4, 0.4.5, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 4.0.0 |
| [sui-framework-helpers](https://dependencywatch.io/package/crates/sui-framework-helpers) | crates.io |  |
| [sui-move-build-helper](https://dependencywatch.io/package/crates/sui-move-build-helper) | crates.io |  |
| [sui-sdk-build-utils](https://dependencywatch.io/package/crates/sui-sdk-build-utils) | crates.io |  |
| [token-usage-tracker](https://dependencywatch.io/package/npm/token-usage-tracker) | npm | 1.0.0, 1.0.1, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1 |
| [wallet-backup-verifier](https://dependencywatch.io/package/npm/wallet-backup-verifier) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 4.0.0 |
| [wallet-security-checker](https://dependencywatch.io/package/npm/wallet-security-checker) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 4.0.0 |
| [web3-secrets-detector](https://dependencywatch.io/package/npm/web3-secrets-detector) | npm | 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.8, 2.3.9, 4.0.0 |
| [workspace-config-loader](https://dependencywatch.io/package/npm/workspace-config-loader) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1 |

## What happened

On 2026-05-22 at 20:20:18 UTC, Socket observed the first **TrapDoor** package - `eth-security-auditor@0.1.0` on PyPI - and the campaign expanded in waves across npm, PyPI and crates.io through the weekend. By 2026-05-25 it spanned **34+ packages and 384+ versions/artifacts**, with some already pulled and others still live. Socket flagged releases in a median of roughly 5–6 minutes (fastest 58 seconds), classifying most as malicious before meaningful adoption.

Xygeni independently tracked an overlapping cluster as **AuditorTrap**: a 22-package fake "Web3 security guild" catalogue published by `ddjidd5640` (a sibling of the `ddjidd564` GitHub account Socket tied to the npm/PyPI/crates payloads), branded as the fabricated **Crypto Security Guild**, **Web3 Audit Collective**, and **DeFi Security Alliance** - none of which exist as real organisations; their GitHub orgs are empty shells that exist only to populate the npm "author" hyperlink. Xygeni split the catalogue into two active payload families - **Variant A** (8 credential-harvesting packages with a `postinstall` hook plus an MCP-tool `scanner.js` that runs when an AI agent invokes the package) and **Variant B** (5 Pinggy-based binary droppers) - plus one dormant tranche.

Rather than typosquatting existing libraries, TrapDoor invents plausible-sounding tools aimed at crypto, DeFi, Solana, AI and security developers. Verified npm releases include `prompt-engineering-toolkit`, `token-usage-tracker`, `solidity-deploy-guard`, `defi-threat-scanner`, `eth-wallet-sentinel`, `wallet-security-checker`, `web3-secrets-detector`, `wallet-backup-verifier`, `crypto-credential-scanner`, `defi-env-auditor`, `chain-key-validator`, `mnemonic-safety-check`, `deployment-key-auditor`, `llm-context-compressor`, `model-switch-router`, `async-pipeline-builder`, `build-scripts-utils`, `dev-env-bootstrapper`, `node-setup-helpers`, `project-init-tools`, and `workspace-config-loader`. PyPI mirrors the theme with `eth-security-auditor`, `defi-risk-scanner`, `cryptowallet-safety`, `data-pipeline-check`, `env-loader-cli`, `git-config-sync`, and `solidity-build-guard`. Crates.io hosts six Sui/Move-flavoured names (`move-project-builder`, `sui-sdk-build-utils`, `sui-framework-helpers`, `sui-move-build-helper`, `move-analyzer-build`, `move-compiler-tools`) - names that read exactly like the dev helpers, model-routing utilities, Solidity tooling and Sui/Move build helpers their targets routinely install.

Execution is ecosystem-specific. npm packages run a `postinstall` hook that loads `trap-core.js`, a ~1,149-line credential harvester and propagation tool; Rust crates abuse `build.rs` to locate local keystores, XOR-encrypt them with the hard-coded key `cargo-build-helper-2026`, and exfiltrate to GitHub Gists; PyPI packages execute at import time. Stolen data includes SSH keys, Solana/Sui/Aptos wallet keystores, AWS credentials, GitHub tokens, browser login databases, crypto-wallet extension data, environment variables, API keys and local dev configuration files.

TrapDoor's standout technique poisons AI coding assistants. The attacker plants hidden instructions - concealed with zero-width Unicode characters - inside `CLAUDE.md` and `.cursorrules` files, tricking tools like **Claude Code** and **Cursor** into running a bogus "security scan" that silently executes the stealer. The campaign is anchored to the GitHub accounts `ddjidd564` / `ddjidd5640` (payloads served from `ddjidd564.github.io/defi-security-best-practices/`) and tagged with the internal marker `P-2024-001`.

- npm versions encoded below were re-verified against the npm registry API on 2026-05-26; every entry is now in a `0.0.1-security` holding state, confirming npm pulled the malicious releases.
- PyPI projects in the packages map are confirmed in PyPI admin "quarantined" status (cannot be installed, cannot be modified by maintainer) per PyPI project pages fetched 2026-05-26.
- The six crates.io names are encoded with `affectedVersions: []` (match by name only) because Socket's appendix is still rate-limited and crates.io returns 404 for the names - consistent with a yank.
- Socket's underlying article (`socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates`) and Xygeni's AuditorTrap write-up remain bot-blocked (HTTP 403) at ingest time; verification was driven via npm/PyPI registry APIs, GitHub Security Advisories search, The Hacker News, gbhackers, and Cyber Kendra coverage.

## Impact

- Crypto wallet theft: Solana / Sui / Aptos keystores and browser wallet-extension data
- SSH private keys, AWS credentials, GitHub tokens, and `.env` / API keys exfiltrated to GitHub Gists
- Browser login databases and local development configuration harvested
- AI coding assistants (Claude Code, Cursor) coerced into running the stealer via hidden prompt injection in `CLAUDE.md` / `.cursorrules`
- Install-time code execution: npm `postinstall`, Rust `build.rs` (cargo build), Python import-time
- Variant B droppers tunnel out over Pinggy, bypassing many corporate egress controls

## What to do

1. Audit dependency trees for newly-added crypto/DeFi/AI "security" or "build" helper packages added since 2026-05-19 - see the packages map below for the verified name set
2. Install with scripts disabled where possible (`npm ci --ignore-scripts`) and review `build.rs` in any new Rust dependency before compiling
3. Inspect `CLAUDE.md`, `.cursorrules`, and other AI-assistant config files for hidden / zero-width Unicode instructions before letting an agent act on them
4. Rotate any SSH keys, cloud credentials, GitHub tokens, API keys, and crypto wallet keys exposed on machines that installed a suspect package
5. Block egress to `ddjidd564.github.io`, Pinggy tunnels (`*.pinggy.link` / `*.free.pinggy.link`), and audit GitHub Gist exfiltration; the campaign is anchored to the `ddjidd564` / `ddjidd5640` GitHub accounts and the internal marker `P-2024-001`
6. Distrust the fabricated brands "Crypto Security Guild", "Web3 Audit Collective", "DeFi Security Alliance" - none of these collectives exist as real organisations

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [TrapDoor crypto stealer supply chain attack hits 34 packages across npm, PyPI, and crates.io](https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates) - Socket
- [AuditorTrap: a 22-package fake crypto security guild on npm with two parallel payloads](https://xygeni.io/blog/auditortrap-a-22-package-fake-crypto-security-guild-on-npm-with-two-parallel-payloads/) - Xygeni
- [TrapDoor supply chain attack spreads credential-stealing malware via npm, PyPI, and CratesIO](https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html) - The Hacker News
- [Malicious packages on npm, PyPI, and Crates.io steal crypto wallets, SSH keys, and cloud credentials](https://www.cyberkendra.com/2026/05/malicious-packages-on-npm-pypi-and.html) - Cyber Kendra
- [Hackers compromised 34 packages in npm, PyPI, and crates in new supply chain attack](https://www.cryptika.com/hackers-compromised-34-packages-in-npm-pypi-and-crates-in-new-supply-chain-attack/) - Cryptika

---

Canonical page: https://dependencywatch.io/incident/multi-2026-05-22-trapdoor-crypto-stealer
Markdown version: https://dependencywatch.io/incident/multi-2026-05-22-trapdoor-crypto-stealer.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).