Socket warns of a supply chain attack named TrapDoor targeting crypto and AI developers, affecting numerous packages and stealing sensitive data.
Socket has alerted users to a significant supply chain attack aimed at cryptocurrency and AI developers, known as TrapDoor. This malicious campaign has affected 34 packages and 384 variations, released repeatedly by attackers across multiple ecosystems.
Identified on May 22, TrapDoor seeks to steal sensitive information, including wallet details and cloud account credentials, from developers involved in crypto, DeFi, and AI security. Popular wallets such as Coinbase, Binance, and MetaMask, along with the Brave browser, are among the targets.
Attack Mechanism
Malware embedded in the software aims to manipulate AI programming assistants like Claude and Cursor. Socket revealed that the attackers intend to trick these tools into executing workflows that expose sensitive data.
Notably, the attack exploits common developer resources, with npm, PyPI, and Crates being the main targets. Several npm packages were found to utilize shared modules designed to search for secret data from developers' environments.
Socket advises developers to consider environments with these packages as compromised, recommending the change of keys and tokens, and thorough checks for any persistence mechanisms. Merely removing the compromised software is not sufficient to eliminate the risk.
Furthermore, the malicious modules are deceptively named to resemble legitimate developer tools, complicating detection efforts. The breach is attributed to a hack of GitHub, which allowed unauthorized access to 3,800 internal repositories.
This incident highlights the growing threat of supply chain attacks in the rapidly evolving tech landscape, particularly within the cryptocurrency and AI sectors.
