TrapDoor Attack Targets Wallet Data from Solana, Sui, and Aptos

Malicious Packages Target Crypto Developers

A sophisticated supply-chain attack named TrapDoor has emerged, specifically targeting developers in the cryptocurrency and cloud sectors. This campaign has introduced over 34 malicious packages across popular open-source repositories, including npm, PyPI, and Crates.io.

These deceptive packages, disguised as benign developer tools and security utilities, are designed to extract sensitive information such as SSH keys, GitHub tokens, AWS credentials, and wallet data. Researchers from the security firm Socket identified the attack, emphasizing that it prioritizes developers who often store critical credentials on their devices.

Methodology of the Attack

Unlike typical attacks that aim for a broad audience, TrapDoor is crafted to infiltrate the developer community. The attackers utilized ordinary-sounding package names like "wallet-security-checker" and "defi-risk-scanner" to avoid raising suspicion. Once installed, these packages could scan for private keys and other sensitive information, executing commands that could compromise entire systems.

Additionally, the attack cleverly manipulates AI configuration files, embedding hidden commands that could hijack future AI coding sessions. This tactic allows attackers to run deceptive security scans, further exfiltrating sensitive data.

Socket has not disclosed specific victims or the extent of stolen assets, but the firm confirmed that these malicious packages were actively exploiting vulnerabilities within the targeted developer environments.

Ongoing Threat and Precautions

As the TrapDoor attack continues to unfold, security experts urge developers to exercise caution when installing new packages. The attack exemplifies a growing trend in cyber threats that specifically target individuals who have access to sensitive data and production environments. Socket has reported the malicious packages to the relevant registries, classifying them as harmful and urging vigilance within the developer community.