supply-chain
TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO
High
Summary
A sophisticated supply chain attack, dubbed TrapDoor, is spreading credential-stealing malware across npm, PyPI, and Crates.io, targeting developers in the crypto, DeFi, Solana, and AI communities. The attack utilizes a multi-faceted approach, including malicious packages with JavaScript payloads, Rust crates for data exfiltration, and even leveraging AI tools to execute hidden instructions and steal secrets. This highlights a growing trend of attackers targeting developer workflows to gain deeper access to systems.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data