TrapDoor Malware Campaign Targets Aptos, Solana, and Sui Developer Ecosystems
TrapDoor malware spread through fake crypto developer packages across registries.Attackers targeted SSH keys, AWS tokens, and wallet credentials in builds worldwide.Researchers linked coordinated uploads to Aptos, Sui, and Solana tooling ecosystems. Researchers have uncovered a coordinated malware campaign that targets cryptocurrency developers through fake software packages spread across major coding registries. The operation, named TrapDoor, focused on developer environments connected to blockchain ecosystems such as Aptos, Sui, and Solana. Security analysts warned that the campaign aimed to steal sensitive credentials from machines used in crypto development workflows. Researchers from Socket Security discovered more than 34 malicious packages distributed across npm, PyPI, and Crates.io. Altogether, the campaign involved more than 384 package versions. The attackers designed the software to appear legitimate by mimicking popular development utilities and blockchain tooling. Malware Targets Developer Credentials The malicious packages targeted high-value information stored on developer systems. The malware searched for SSH keys, AWS credentials, GitHub access tokens, wallet keystores, and browser login databases. Consequently, compromised systems could expose both personal and corporate infrastructure tied to crypto projects. Researchers identified several suspicious Rust packages on Crates.io, including sui-framework-helpers, move-analyzer-build, and sui-move-build-helper. Additionally, npm packages carried names such as crypto-credential-scanner and wallet-security-checker. PyPI packages included eth-security-auditor and defi-risk-scanner. The attackers relied on









