POPA ReconTrapDoor Malware Targets Crypto Devs Across Aptos, Sui & Solana
TrapDoor Malware Targets Crypto Devs Across Aptos, Sui & Solana Researchers at Socket Security uncovered a TrapDoor malware campaign spanning npm, PyPI, and Crates io, with 34+ malicious packages across 384+ versions targeting crypto developer environments. The packages impersonate tools for ecosystems like Aptos, Sui, and Solana, using names such as sui-framework-helpers and move-project-builder. They trigger automatically via install hooks, Python imports, and Rust build scripts. Once executed, the malware steals SSH keys, wallet keystores, AWS credentials, GitHub tokens, and browser log…
The excerpt is quoted from a public Telegram channel, which owns its text.