Back Ground.News

Cryptocurrency and AI Developers Face New Cybersecurity Threat

Ground.News • May 25, 2026

utesKey Takeaways: TrapDoor is the first documented supply chain campaign to simultaneously compromise npm, PyPI, and Crates.io registries. Socket identified more than 34 malicious packages and 384 artifacts, with a median detection time of 5 minutes and 27 seconds post-release. The malware targets AI coding tools like Cursor and Claude by embedding hidden instructions inside custom rulesets using invisible characters. Securi…

Key Takeaways A newly discovered malware campaign known as “TrapDoor” is targeting developers building on major crypto networks, including Aptos, Sui, and Solana. Researchers at ...

Blockchain security firm SlowMist warns of a cross-registry supply chain campaign targeting developers in the Solana, decentralized finance, and AI sectors to siphon private keys.

The post Cryptocurrency and AI Developers Face New Cybersecurity Threat appeared on BitcoinEthereumNews.com. A new malware campaign dubbed TrapDoor has been identified by cybersecurity firm Socket, posing a significant threat to developers in the fields of cryptocurrency and artificial intelligence. This extensive operation involves the distribution of malicious packages across popular developer platforms, targeting software developers by infilt…

The malware spread through npm, PyPI, and Rust packages in coordinated waves. It steals crypto wallets, SSH keys, and cloud developer credentials. AI coding tools were also targeted through malicious config files. A coordinated malware campaign known as TrapDoor has hit software ecosystems widely used by crypto and blockchain developers. Security researchers identified dozens of malicious packages spread across major open-source repositories, al…

A new supply-chain malware campaign named TrapDoor is targeting crypto and AI developer environments through malicious packages published across npm, PyPI and Crates.io. The campaign spans more than 34 malicious packages and 384 related versions, with payloads designed to steal SSH keys, wallet data, AWS credentials, GitHub tokens, browser profiles, API keys, environment variables and local development configuration files. The affected package n…

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into legitimate packages, which execute during installation to steal sensitive credentials from developers and CI/CD environments. The malware collects data such as GitHub tokens, npm credentials, and cloud secrets, exfiltrating them via public GitHub repositories. Researchers have linked this campaign to the TeamPCP threat actor group, known for similar tactics in previous attacks. At least four SAP-related npm packages have been confirmed as compromised, with the malicious payload being designed to propagate further across the npm ecosystem. The attack is ongoing, and organizations are advised to review their environments for affected packages and rotate any exposed secrets. 753 sources 71

Extracted Entities

Cryptocurrency and AI Developers Face New Cybersecurity Threat

The full story

Extracted Entities

Attack Types (2)

Domains (1)

MITRE ATT&CK (1)

Platforms (3)

Tools (1)