TrapDoor’s credential theft campaign hits Solana developers via 384+ versions

First disclosed by SocketSecurity on May 24 , the TrapDoor credential theft campaign targets Solana developers. According to SlowMist, more than 384 malicious package versions are spread across npm, PyPI and Crates.io, while the Coinfomania report places the same total across npm and PyPI. The operation puts developers’ credentials at the center of a threat spanning package platforms. TrapDoor’s malicious packages target Solana developers The campaign’s reported scale includes both the number of packages and the versions distributed. More than 34 malicious packages target crypto and decentralized finance, or DeFi, developers.