TrapDoor campaign deploys 34 malicious open source packages

A coordinated malware campaign known as TrapDoor has infiltrated major open source software ecosystems, deploying more than 34 malicious packages designed to steal cryptocurrency wallet credentials, cloud access tokens, and SSH keys from developers. Security researchers identified the operation across the npm, PyPI, and Crates.io package repositories, which are widely used by programmers working in cryptocurrency, decentralized finance, artificial intelligence, and cybersecurity.

The earliest activity was recorded on May 22, 2026, with packages published in rapid waves from multiple accounts. Researchers said the campaign involved over 384 malicious versions distributed within a short window. The packages were disguised as common development utilities, including project setup tools, model routing libraries, and compilation frameworks for blockchain platforms such as Solidity, Sui, and Move. This disguise allowed the malware to blend into routine dependency updates that developers install as standard workflow procedures.

Once installed, the malware executes automatically through standard build and installation processes. JavaScript packages trigger malicious code through...