Chiến dịch đánh cắp tiền điện tử TrapDoor nhắm vào npm, PyPI và Crates.io với hơn 34 gói độc hại

The security company Socket Security has discovered a cryptocurrency-stealing supply chain attack named TrapDoor, spanning npm, PyPI, and Crates.io, involving over 34 malicious packages and 384 related versions and artifacts, targeting developers in cryptocurrency, DeFi, Solana, Sui, Move, and AI. The attack samples can steal sensitive information such as SSH keys, wallet data, AWS credentials, GitHub tokens, browser data, and environment variables. The npm packages execute the shared payload trap-core.js via postinstall hooks, PyPI packages execute remote JavaScript upon import, and Crates.io packages leverage build.rs to steal local keychains. Socket has flagged all related packages as malicious and reported them to the respective package registries.