Back Kucoin

TrapDoor Crypto Theft Campaign Targets npm, PyPI, and Crates.io with 34+ Malicious Packages

Kucoin • May 25, 2026

According to research by security firm Socket Security, a cryptocurrency-stealing supply chain attack named TrapDoor spans npm, PyPI, and Crates.io, involving over 34 malicious packages and 384 associated versions and artifacts, targeting developers in cryptocurrency, DeFi, Solana, Sui, Move, and AI. The attack samples steal sensitive information such as SSH keys, wallet data, AWS credentials, GitHub tokens, browser data, and environment variables. npm packages execute a shared payload, trap-core.js, via postinstall hooks; PyPI packages execute remote JavaScript upon import; and Crates.io packages leverage build.rs to steal local keychains. Socket has flagged all related packages as malicious and reported them to the respective package registries.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into legitimate packages, which execute during installation to steal sensitive credentials from developers and CI/CD environments. The malware collects data such as GitHub tokens, npm credentials, and cloud secrets, exfiltrating them via public GitHub repositories. Researchers have linked this campaign to the TeamPCP threat actor group, known for similar tactics in previous attacks. At least four SAP-related npm packages have been confirmed as compromised, with the malicious payload being designed to propagate further across the npm ecosystem. The attack is ongoing, and organizations are advised to review their environments for affected packages and rotate any exposed secrets. 753 sources 71

Extracted Entities

TrapDoor Crypto Theft Campaign Targets npm, PyPI, and Crates.io with 34+ Malicious Packages

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

CWE Weaknesses (1)

MITRE ATT&CK (3)

Platforms (2)

Tools (1)