TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages…

MITRE Techniques

• [T1204.002 ] User Execution: Malicious File – PyPI packages execute attacker-supplied code when imported, causing remote JavaScript to run via node -e (‘download JavaScript from the attacker-controlled GitHub Pages domain, and run it using node -e’).
• [T1059.007 ] Command and Scripting Interpreter: JavaScript – The campaign relies on JavaScript payloads in npm and PyPI to perform credential theft and follow-on actions (‘shared trap-core.js payload’, ‘download JavaScript … and run it’).
• [T1059.006 ] Command and Scripting Interpreter: Python – Python package import time is used as an execution path to trigger malicious behavior (‘PyPI packages that execute remote JavaScript payloads on import’).
• [T1068 ] Exploitation for Privilege Escalation – The npm payload attempts SSH-based lateral movement to expand access after stealing keys (‘attempts SSH-based lateral movement’).
• [T1552.001 ] Unsecured Credentials: Credentials In Files – The malware scans local files and environments for secrets and configuration data (‘scans for credentials’, ‘Local development configuration files’).
• [T1552.004 ] Unsecured Credentials: Private Keys – It steals SSH keys and wallet keystores/private material from developer systems (‘SSH keys’, ‘Sui, Solana, and Aptos wallet data’).
• [T1528 ] Steal Application Access Token – The payload validates and steals AWS and GitHub tokens to access cloud and code assets (‘validates stolen credentials using AWS and GitHub API calls’).
• [T1119 ] Automated Collection – The malicious code systematically gathers browser data, environment variables, keys, and credentials at scale (‘credential harvester’, ‘collect a broad set of developer secrets’).
• [T1546.001 ] Event Triggered Execution: Change Default File Association / Hook – npm persistence uses Git hooks, shell hooks, cron, and systemd mechanisms to maintain execution (‘Git hooks’, ‘Shell hook’, ‘systemd services’, ‘cron jobs’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – The campaign establishes persistence through system startup-style mechanisms including systemd and cron (‘systemd services’, ‘cron jobs’).
• [T1053.003 ] Scheduled Task/Job: Cron – The malware uses cron jobs for persistence and repeated execution (‘cron jobs’).
• [T1053.006 ] Scheduled Task/Job: Systemd Service – It plants systemd services to keep the payload active (‘systemd services’).
• [T1027 ] Obfuscated Files or Information – Hidden/bidirectional Unicode and zero-width characters are used to disguise malicious instructions (‘hidden or bidirectional Unicode text’, ‘zero-width Unicode characters’).
• [T1566.001 ] Phishing: Spearphishing Attachment – The attacker uses AI-facing project files as a lure for hidden instructions in repos (‘docs: add .cursorrules’, ‘docs: add CLAUDE.md’).
• [T1218 ] System Binary Proxy Execution – build.rs and package lifecycle hooks are used as trusted execution paths inside package tooling (‘use build.rs’, ‘postinstall execution’).