The TrapDoor credential theft campaign, first revealed by SocketSecurity on May 24, is specifically targeting Solana developers. According to SlowMist, over 384 malicious package versions have been identified across npm, PyPI, and Crates.io, while Coinfomania reports the same total across npm and PyPI. This operation primarily aims to steal developers’ credentials, making it a significant threat to the security of package platforms.
The scale of the TrapDoor campaign is notable for both the number of packages and the versions distributed. More than 34 malicious packages are directed at crypto and decentralized finance (DeFi) developers, a figure separate from the total of 384 malicious versions reported. The focus on developers underscores the critical need for enhanced security measures within the developer community.
SlowMist’s analysis delves into sample attacks, their mechanisms, and potential vulnerabilities, providing a technical breakdown of the TrapDoor campaign. This work complements SocketSecurity’s initial disclosure. SlowMist emphasizes the importance of heightened vigilance among developers, advocating for continuous threat monitoring and intelligence sharing to mitigate the credential-theft risks posed by this campaign.