TrapDoor

Named by 2 kept items in this workspace.

Search every workspace for TrapDoor. It matches the name as written, so it can find other things that share it.

The items that name it 2

Socket: TrapDoor Crypto Stealer
writeup2026-05-26
Cross-ecosystem campaign spanning npm, PyPI, and Crates.io with 34+ malicious packages and 384+ related versions/artifacts targeting crypto, DeFi, Solana, and AI developer communities; uses shared infrastructure, campaign marker P-2024-001, and AI-agent prompt injection via .cursorrules and CLAUDE.m
shai-hulud-detect: multi-ecosystem npm/PyPI/Composer/Crates/Go/Hex/RubyGems supply-chain worm scanner
repoIt is written here as TrapDoor (campaign where every version of the package is malicious).
campaign where every version of the package is malicious

All threat actors in this workspace.