TrapDoor: The Supply Chain Campaign That Wants Your Whole Dev Environment, Not Just Your Secrets

More than 34 malicious packages and 384 related versions and artifacts have been confirmed across npm, PyPI, and Crates.io as part of a campaign Socket researchers are tracking as TrapDoor. If your team installs open-source dependencies from any of those three registries without automated behavioral scanning, you are in the blast radius.

This is not the usual "poisoned package steals an AWS key" story. TrapDoor is engineered around the full developer workflow. Socket found evidence the packages targeted AWS credentials, GitHub tokens, SSH keys, browser data, environment variables, crypto wallets, and local development configuration files. But the part that should get your attention is what came next: the malware also attempted to manipulate files used by AI coding tools, specifically .cursorrules and CLAUDE.md, by injecting hidden Unicode instructions designed to trick AI assistants into running security-scan-like routines that could surface and exfiltrate secrets.

So the attack surface is not your perimeter. It's the laptop your most trusted engineer uses to push to production.

How the execution works

Each registry was abused through its own native mechanisms, which is exactly what makes this hard to catch with single-ecosystem controls. In npm, the packages relied on postinstall scripts. In PyPI, import-time execution fetched and ran remote JavaScript. In Crates.io (a detail that surprised some defenders), Rust build scripts that execute during compilation were weaponized. Normal behavior. Malicious payload.

"TrapDoor represents a shift from opportunistic package abuse toward workflow-level compromise of developer environments," said Sakshi Grover, senior research manager for IDC Asia Pacific Cybersecurity Services. "Earlier campaigns typically placed a malicious package, stole credentials on install, and moved on. TrapDoor is engineered around the full developer workflow, meaning the attack extends well beyond the package registry."

Grover also pointed out that the cross-registry design makes single-ecosystem monitoring insufficient. You need visibility across all three registries simultaneously, or you are only seeing part of the picture.

Sanchit Vir Gogia, chief analyst at Greyhound Research, said the campaign demonstrates an intimate understanding of how modern software is built. "It targets the wider developer operating environment: package managers, AI coding assistants, Git hooks, shell profiles, SSH trust relationships, browser sessions, cloud credentials, CI/CD pathways, and the local workflow artifacts that developers and machines increasingly treat as legitimate context" (that last phrase about machine reasoning context is worth sitting with for a moment).

And once an attacker has an SSH key and a foothold on the workstation, they are not stuck at the perimeter. "A single compromised workstation can quietly become an entry point into CI/CD pipelines and build infrastructure," said Grover. "That's not credential theft. That's an initial access operation."

Keith Prabhu, founder and CEO at Confidis, flagged hardened developer endpoints, package allowlisting, and AI tooling governance as priorities CISOs should push down to their teams now.

Defender checklist

1. Enable automated install-time scanning against known-malicious packages and flag unexpected postinstall scripts, remote payload fetching, or anomalous outbound network calls — lockfiles alone are not enough.
2. Rotate and scope developer credentials to short-lived, least-privilege tokens; strip AWS keys and GitHub tokens out of environment variables and local config files wherever possible.
3. Audit your AI coding assistant configuration files (.cursorrules, CLAUDE.md, and equivalents) for unexpected Unicode characters or injected instructions.
4. Extend your dependency scanning to all three registries — npm, PyPI, and Crates.io — rather than treating them as separate problems.
5. Treat developer workstations as production-adjacent infrastructure and apply the same access segmentation you'd use for a cloud production account.