Socket Identifies TrapDoor Crypto-Theft Campaign Targeting Developers

Security firm Socket has uncovered a crypto-theft campaign named TrapDoor, targeting developers with wallet keys and cloud credentials, according to CoinDesk. The attack, spread across npm, PyPI, and Crates.io, involves over 34 malicious packages disguised as developer tools. These packages, once installed, attempt to steal sensitive data such as private keys, passwords, and GitHub tokens. The campaign uses social engineering and supply-chain attacks to infiltrate developer environments, aiming to exfiltrate secrets and maintain access. Socket has reported the malicious packages to affected registries.