TrapDoor Crypto Stealer Hits Multiple Packages Across npm PyPI Crates
A recently discovered supply chain attack has compromised multiple packages across npm, PyPI, and Crates.io, affecting hundreds of versions. The attack, known as TrapDoor, involves a crypto stealer that targets developer secrets and cloud credentials. This vulnerability affects a wide range of users, from individual developers to large enterprises, and has the potential to cause significant financial and reputational damage. The scale of impact is substantial, with over 34 packages and hundreds of versions compromised. The affected packages include popular libraries and frameworks used in various industries.
The attack vector involves the compromise of packages on popular repositories, allowing attackers to inject malicious code into the software supply chain. The delivery method is through the use of typosquatting and DNS backdoors, which enable the execution of commands and the exfiltration of sensitive data. The exploitation chain is complex, involving multiple steps and techniques, including social engineering, code injection, and data encryption. The attackers have used various tactics, including the impersonation of popular packages and the creation of fake repositories, to distribute the malware. The use of DNS backdoors has also allowed the attackers to maintain persistence and evade detection.
Overall, this campaign highlights the growing risk of dependency-based attacks in modern software development. As developers increasingly rely on open-source components, trust in package registries becomes a critical attack surface. The incident reinforces the importance of dependency auditing, package verification, and continuous monitoring of third-party libraries to reduce exposure to stealthy supply chain threats.
Attack Surface
Supply Chain (Third-party vendors), Endpoint, Cloud Service
Tactics
Initial Access, Execution, Exfiltration, Persistence
Techniques
- T1190 – Exploit Public-Facing Application
- T1204 – User Execution
SuperPRO's Threat Countermeasures Procedures
- Audit installed dependencies using lock files (package-lock.json, requirements.txt, Cargo.lock) and remove any package versions matching indicators of compromise or unknown publishers. Reinstall clean versions directly from official repositories only.
- Rotate all exposed cryptographic credentials and API keys used in development environments.
- Block outbound connections to known malicious command-and-control (C2) infrastructure.
- Ensure developers do not store production secrets locally. Use vault-based secret management (e.g., HashiCorp Vault, AWS Secrets Manager) instead of plaintext environment variables.
- Continuously scan for malicious or newly compromised packages across all repositories.
- Deploy endpoint detection rules to flag unusual process behavior from package managers.
- Enforce npm package-lock.json integrity, Python hashes in requirements.txt, and Rust cargo-audit or cargo-crev to prevent unsigned or tampered package installations.