TrapDoor Campaign Plants Credential Stealers Across npm, PyPI, and Crates.io

A coordinated supply chain campaign tracked as TrapDoor has been quietly seeding credential-stealing payloads into npm, PyPI, and Crates.io since late May 2026, with researchers counting more than 34 malicious packages spanning over 384 versions. The first publication landed on May 22, 2026 at 8:20 p.m. UTC, and new waves have continued from what appears to be a single operator cluster reusing infrastructure across all three ecosystems.

That cross-registry behavior is the part that should worry you. Most typosquatting and dependency confusion campaigns stay inside one language ecosystem because the tooling, naming conventions, and audiences differ. TrapDoor does not. The operators are publishing parallel lures in JavaScript, Python, and Rust, which means a single developer machine pulling polyglot dependencies (think a data team running Python notebooks alongside a Node front-end and a Rust CLI tool) can be hit from three directions before anyone notices a single bad import.

The payloads themselves are straightforward infostealers. They grab browser-stored credentials, cloud CLI tokens (AWS, GCP, npm auth tokens), SSH keys, and shell history, then exfiltrate to attacker-controlled endpoints. Nothing exotic. The interesting work was on the distribution side, not the malware side.

And that is the lesson here. You are not going to out-engineer a determined publisher who can spin up package names faster than registries can take them down. The defense is not vigilance, it is plumbing.

A few practical notes before the checklist. Crates.io malicious packages are still rare enough that many Rust shops have no review process at all, so if your team uses Cargo, assume zero baseline. npm remains the highest-volume target and the easiest place to get burned through transitive dependencies. PyPI sits in the middle, but Python's habit of executing setup.py at install time means a malicious package can pop a shell before you have even imported it.

Developers tend to trust the registry. The registry trusts the publisher. The publisher is whoever signed up last Tuesday with a Proton address.

What to do this week:

1. Pin and hash-lock every direct dependency. Use package-lock.json, requirements.txt with hashes (pip install --require-hashes), and Cargo.lock committed to the repo. No floating versions in CI.
2. Route all installs through an internal proxy (Artifactory, Nexus, or Sonatype) with a quarantine window of at least 48 hours on new package versions. Most TrapDoor packages were yanked within that window.
3. Revoke and rotate any developer-machine cloud tokens that have been sitting in ~/.aws/credentials or ~/.npmrc for more than 90 days, and move them behind short-lived SSO-issued credentials.
4. Add a CI check that fails the build on any dependency published less than 14 days ago unless explicitly allowlisted.
5. Run Socket or a similar package-behavior scanner against your lockfiles weekly. It catches the install-time shell tricks that signature-based scanners miss.

The packages will keep coming. Your job is to make sure the next one cannot reach a token that matters.