TLDR Tech / InfoSec
TrapDoor malware campaign puts developer workstations in CISO spotlight
Socket researchers tracked TrapDoor, a campaign spanning 34+ malicious packages and 384+ versions across npm, PyPI, and Crates.io that abuses each ecosystem's native execution points (postinstall scripts, import-time execution, and Rust build scripts) to steal AWS credentials, GitHub tokens, SSH keys, and crypto wallets, while also tampering with AI coding assistant files like .cursorrules and CLAUDE.md via hidden Unicode instructions. Analysts frame the campaign as a shift from opportunistic package abuse toward workflow-level compromise, where a single poisoned workstation becomes an initial-access foothold into CI/CD pipelines and build infrastructure rather than a one-off credential theft. The broader takeaway for CISOs is to treat developer environments as production-adjacent infrastructure, enforcing install-time behavioral scanning, package allowlisting, scoped short-lived credentials, AI tooling governance, and zero-trust controls inside local dev workflows.
Read the full story