AI Summary

Researchers at Socket identified a malicious package campaign called TrapDoor that spans more than 34 malicious packages and 384+ related versions across npm, PyPI, and Crates.io. The malware targets developer workflows and AI coding assistant files, stealing secrets such as AWS credentials, GitHub tokens, SSH keys, browser data, environment variables, crypto wallets, and local development configuration files. The packages exploit common development execution points: npm uses postinstall scripts, while PyPI employs import‑time execution to fetch and run remote JavaScript. The campaign highlights how a single compromised workstation can expose cloud infrastructure, CI/CD pipelines, AI tools, and privileged credentials.

AI summaries can be wrong sometimes—always verify important details using the source article.