TrapDoor’s credential theft campaign hits Solana developers via 384+ versions

First disclosed by SocketSecurity on May 24, the TrapDoor credential theft campaign targets Solana developers. According to SlowMist, more than 384 malicious package versions are spread across npm, PyPI and Crates.io, while the Coinfomania report places the same total across npm and PyPI. The operation puts developers’ credentials at the center of a threat spanning package platforms.

TrapDoor’s malicious packages target Solana developers

The campaign’s reported scale includes both the number of packages and the versions distributed.

More than 34 malicious packages target crypto and decentralized finance, or DeFi, developers. That package count is distinct from the total of more than 384 malicious versions reported across the campaign.

TrapDoor’s objective is credential theft among Solana developers. The campaign’s focus on developers places developer security at the center of the reported threat.

The distribution of malicious packages across package platforms complicates security considerations for developers using those platforms.

SlowMist’s analysis examines sample attacks, their underlying mechanisms and potential vulnerabilities. Its work provides a technical examination of the TrapDoor campaign alongside SocketSecurity’s initial disclosure.

SlowMist stresses heightened vigilance among developers. The reported security priorities also include continuous threat monitoring and intelligence sharing to help mitigate the campaign’s credential-theft threat.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.