CERT24Credential-Stealing Malware Distributed via npm, PyPI, and Crates.io in TrapDoor Supply-Chain AttackLoading data…
CERT24Threat Observatory
Period

Credential-Stealing Malware Distributed via npm, PyPI, and Crates.io in TrapDoor Supply-Chain Attack

A coordinated software supply-chain attack campaign codenamed TrapDoor used npm, PyPI, and Crates.io to distribute more than 34 malicious packages across over 384 versions. The malware targeted developer secrets, crypto wallets, SSH keys, cloud credentials, browser data, and environment variables.

← Back to intelligence

Credential-Stealing Malware Distributed via npm, PyPI, and Crates.io in TrapDoor Supply-Chain Attack

A coordinated software supply-chain attack campaign codenamed TrapDoor used npm, PyPI, and Crates.io to distribute more than 34 malicious packages across over 384 versions. The malware targeted developer secrets, crypto wallets, SSH keys, cloud credentials, browser data, and environment variables.