Malware campaign targets DeFi developers through npm, PyPI, Rust registries
Security firm Socket disclosed on May 24, 2026 that TrapDoor, a coordinated malware campaign, had seeded more than 34 malicious packages and over 384 related versions across npm, PyPI, and Crates.io. The attack chain targeted developers building and maintaining protocols by stealing GitHub tokens, SSH keys, cloud credentials, and wallet keys before code reached mainnet.
The campaign delivered payloads through ordinary developer workflows. npm packages executed malicious code through postinstall hooks. PyPI packages triggered payloads on import while fetching remote JavaScript. Rust crates ran build.rs scripts during compilation. Each vector operated within standard package manager behavior, reducing detection friction.
Socket found TrapDoor attempted to plant hidden instructions inside configuration files such as .cursorrules and CLAUDE.md, which are read by AI coding assistants like Cursor and Claude Code. The injected instructions employed hidden Unicode techniques to steer AI-assisted workflows toward secret discovery and exfiltration. This represents a shift in exploit vectors: rather than targeting smart contracts directly, attackers compromised the operational systems developers rely on.
The TrapDoor disclosure came weeks after SafeDep documented a related campaign on May 11, 2026 that compromised 170+ npm packages and 2 PyPI packages, totaling 404 malicious versions. One poisoned VS Code extension reached 2.2 million installs. In May 2026 alone, StepSecurity described five major supply-chain attacks occurring within 48 hours.
Recent DeFi incidents illustrate the downstream impact. Resolv suffered a $23 million exploit in March 2026 where deployed code functioned as designed but off-chain infrastructure and trusted keys failed. Drift lost $285 million in April 2026 when attackers combined long-running social engineering with valid admin signatures. KelpDAO lost approximately $292 million in April 2026 after attackers compromised off-chain RPC and DVN infrastructure.
The scale of supply-chain compromise is accelerating. Sonatype reported 454,600 new malicious packages in 2025, bringing the cumulative count to 1.233 million. Socket’s average detection time for malicious packages stands at 5 minutes 56 seconds, though the sheer volume suggests many packages evade initial screening.
Median incident size has compressed. Immunefi data shows the median incident dropped from $6 million in 2022 to $1.5 million in 2025, indicating core contract-level defenses have matured. However, potential losses from single mid-to-large protocol compromises range from $100 million to $300 million.
North Korean hackers dominated crypto theft in 2026. TRM Labs estimated they stole approximately $577 million through April 2026, accounting for 76% of all crypto losses during that period. Chainalysis put total crypto service theft at more than $3.4 billion in 2025, with the top three incidents accounting for 69% of that figure.
The shift from contract-level to infrastructure-level attacks reflects attacker sophistication. Developers now face threats not only in deployed code but in the tools, dependencies, and credentials that precede deployment. Socket’s disclosure underscores that protocol security now depends on hardening supply chains before code reaches mainnet.
