TrapDoor malware targets crypto and AI developers through open-source packages, security firm warns

Cybersecurity firm Socket has issued a warning about a new malware campaign dubbed ‘TrapDoor’ that specifically targets software developers working in cryptocurrency, decentralized finance (DeFi), and artificial intelligence (AI) sectors. According to a blog post published by Socket and reported by Cointelegraph, attackers are uploading malicious packages to widely used developer libraries such as npm and PyPI.

How the TrapDoor malware infects developers

Socket explained that the threat actors behind TrapDoor are embedding malicious code inside seemingly legitimate packages. Developers who unknowingly download and install these packages into their projects become infected. Once active, the malware functions as an info-stealer, designed to extract sensitive data from compromised systems.

The primary targets include cryptocurrency wallet extensions such as MetaMask and Phantom, as well as SSH keys and GitHub authentication tokens. By capturing these credentials, attackers can gain unauthorized access to developers’ digital assets and source code repositories, ultimately leading to asset theft.

Why this matters for the crypto and AI developer community

Developers in the crypto, DeFi, and AI sectors frequently rely on open-source packages to build applications quickly. The npm and PyPI ecosystems are particularly attractive to attackers because they are widely used and often trusted without thorough security vetting. TrapDoor exploits this trust, turning routine dependency installations into a serious security risk.

The theft of MetaMask or Phantom wallet keys could result in the loss of cryptocurrency holdings. Similarly, compromised SSH keys and GitHub tokens could allow attackers to inject further malicious code into production environments or steal intellectual property.

Broader implications for supply chain security

This attack highlights a growing trend in software supply chain threats. Malicious packages targeting developers are becoming more sophisticated, and the TrapDoor campaign is a reminder that even trusted repositories can harbor dangerous code. For organizations building on blockchain or AI platforms, a single infected dependency can cascade into significant financial and reputational damage.

Recommendations for developers

Socket advises developers to exercise caution when adding new dependencies to their projects. Security experts recommend verifying package integrity, using package lock files, and employing automated security tools that scan for suspicious behavior. Additionally, developers should consider using hardware wallets for storing cryptocurrency keys and enabling multi-factor authentication on GitHub accounts.

Conclusion

The TrapDoor malware campaign is a targeted and evolving threat to developers in the crypto, DeFi, and AI sectors. By exploiting trust in open-source repositories, attackers are stealing sensitive credentials that can lead to financial loss and data breaches. Developers and organizations must remain vigilant and adopt proactive security measures to protect their workflows and assets.

FAQs

Q1: What is TrapDoor malware?
TrapDoor is an info-stealer malware that targets developers by hiding malicious code inside packages on npm and PyPI. It steals cryptocurrency wallet keys, SSH keys, and GitHub tokens.

Q2: Who is at risk from TrapDoor?
Developers working in cryptocurrency, decentralized finance (DeFi), and artificial intelligence (AI) sectors who download packages from npm or PyPI are the primary targets.

Q3: How can developers protect themselves from TrapDoor?
Developers should verify package sources, use lock files, run security scans on dependencies, enable multi-factor authentication on GitHub, and store cryptocurrency keys in hardware wallets.