TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO
A coordinated cross-ecosystem supply chain attack codenamed TrapDoor has hit npm, PyPI, and Crates.io with 34+ malicious packages across 384 versions. The packages deploy credential-stealing malware targeting crypto, DeFi, Solana, and AI developers, stealing secrets, crypto wallets, and SSH keys.