Cryptocurrency theft activities TrapDoor span across npm, PyPI, and Crates.io, involving over 34 malicious packages

Deep Tide TechFlow News, on May 25th, security company Socket Security discovered that a cryptocurrency theft supply chain attack called TrapDoor spans npm, PyPI, and Crates.io, involving over 34 malicious packages and 384 related versions and artifacts, targeting cryptocurrency, DeFi, Solana, Sui, Move, and AI developers.

The attack samples can steal sensitive information such as SSH keys, wallet data, AWS credentials, GitHub tokens, browser data, environment variables, and more. Among them, the npm package executes a shared payload trap-core.js via a postinstall hook, the PyPI package executes remote JavaScript upon import, and the Crates.io package uses build.rs to steal local key repositories. Socket has marked all related packages as malicious and reported them to the relevant package registries.

SOL-0.52%
SUI-2.02%
MOVE-0.91%
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments
  • Pinned