TrapDoor Campaign Targets Solana Developers via Malicious Code Packages
A credential theft campaign named TrapDoor is targeting Solana cryptocurrency developers through malicious packages published on software repositories.
FTMQ Security, written by our newsroom0 views
A credential theft campaign known as TrapDoor is targeting Solana cryptocurrency and decentralized finance developers. The Cryptonomist and TOKENPOST reported that the operation uses malicious packages to steal developer credentials across open-source package registries. [1][3]
The campaign was first disclosed by SocketSecurity on May 24. According to reporting from The Cryptonomist, the operation targets developers in the crypto and decentralized finance sectors. [1]
More than 34 malicious packages have been identified in the campaign. Reports differ on the spread of the malicious code versions across platforms. The Cryptonomist cited SlowMist reporting that more than 384 malicious package versions are distributed across npm, PyPI, and Crates.io. However, Coinfomania reported that the same total of more than 384 malicious versions is spread across npm and PyPI. [1][2][3]
The campaign places developer credentials at the center of a threat spanning multiple software package ecosystems. [1]
In short
- The TrapDoor credential theft campaign targets Solana developers in the crypto and DeFi sectors.
- SocketSecurity first disclosed the TrapDoor campaign on May 24.
- The campaign uses more than 34 malicious packages across software repositories.
- Outlets report more than 384 malicious package versions distributed across npm, PyPI, and Crates.io.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]TrapDoor Credential Theft Solana Targets DevelopersThe Cryptonomist, 12h ago (the report this story comes from)
- [2]Solana Faces Threats from TrapDoor Credential Theft CampaignCoinfomania, 13h ago
- [3]TrapDoor Campaign Targets Solana Developers With More Than 34 Malicious PackagesTOKENPOST, 13h ago
Our newsroom writes these reports with the help of software, from the 3 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- LiteLLM leaked master key enables credential theft and malicious supply chain attackTop Stories, 7d ago
- Meta suffers GitHub breach exposing corporate code and employee dataTop Stories, 18d ago
- Hugging Face repositories hijacked to deploy cryptominers and backdoorsThreat Intelligence, 2d ago
- Trojanized Claude Code Extension Installs Persistent Backdoor on Developer MachinesTop Stories, 1d ago
- Malicious npm Package Discovered Executing Windows Shellcode Injection CampaignTop Stories, 14d ago
More in Threat Intelligence
- VOLTA Infostealer Uses Artificial Intelligence Models to Rank Stolen Victim Data1h ago
- CISA expands known exploited catalog with software vulnerabilities2d ago
- Hitachi Energy warns of critical command injection flaw in CoreTec products2d ago
- Phishing and vishing drive rising Q3 ransomware activity, Cisco Talos finds2d ago
- Unit 42 warns of critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-1096192d ago
- Hugging Face repositories hijacked to deploy cryptominers and backdoors2d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.