Socket: TrapDoor Crypto Stealer

What it is

TrapDoor is an active crypto-stealer supply-chain campaign tracked by Socket, spanning 34+ packages and 384+ versions across npm, PyPI, and Crates.io. The summary covers the mechanism; the value here is the concrete indicators — the package names, publisher accounts, and infrastructure you can check against right now. The earliest observed artifact was the PyPI package eth-security-auditor@0.1.0, uploaded May 22, 2026, 20:20 UTC.

Preconditions / Affected

You're exposed if a developer installed any of these packages. Named indicators:

• npm (publisher asdxzxc): async-pipeline-builder, build-scripts-utils, chain-key-validator, crypto-credential-scanner, defi-env-auditor, defi-threat-scanner, deployment-key-auditor, dev-env-bootstrapper, eth-wallet-sentinel, llm-context-compressor, mnemonic-safety-check, model-switch-router, node-setup-helpers, project-init-tools, prompt-engineering-toolkit, solidity-deploy-guard, token-usage-tracker, wallet-backup-verifier, wallet-security-checker, web3-secrets-detector, workspace-config-loader
• PyPI: cryptowallet-safety, data-pipeline-check, defi-risk-scanner, env-loader-cli, eth-security-auditor, git-config-sync, solidity-build-guard
• Crates.io (Sui/Move targets): move-analyzer-build, move-compiler-tools, move-project-builder, sui-framework-helpers, sui-move-build-helper, sui-sdk-build-utils

What to do

• Grep installed dependencies against the lists above; some remained live at time of writing.
• Hunt these infrastructure indicators: GitHub account ddjidd564, payload host ddjidd564[.]github[.]io/defi-security-best-practices/, and the campaign marker string P-2024-001 (appears across components).
• Check persistence artifacts the npm payload plants: .cursorrules, CLAUDE.md, Git hooks, shell hooks, systemd services, cron jobs, and unexpected authorized_keys/SSH entries.
• Treat any exposed SSH keys, AWS credentials, and GitHub tokens as compromised and rotate — the payload validates them via live AWS/GitHub API calls and reuses SSH keys for lateral movement. Assume connected infrastructure (repos, CI/CD, deployment envs) is in scope.
• Flag dev-env-bootstrapper specifically: it both steals credentials and acts as a delivery vector, spreading malicious config into dev environments.

Caveats

The trap-core.js payload (1,149 lines) is the npm execution path only. PyPI packages instead fetch remote JavaScript on import, and Crates.io packages exfiltrate wallet keystores via build.rs — so scanning for trap-core.js alone will miss two of three ecosystems. Package counts ("34+", "36" in one subhead) are approximate and the set was being actively updated over the reporting window, so absence from these lists is not a clean bill of health.