‘TrapDoor’ malware targets crypto dev tools in supply chain attack
TrapDoor malware campaign deployed 34+ malicious packages targeting crypto and AI developers across npm, PyPI, and Crates repositories. The attack steals wallet data, SSH keys, GitHub tokens, and cloud credentials while hijacking AI coding assistants like Claude and Cursor. Targets include Coinbase, Binance, Solana, MetaMask, and other major wallets, posing significant risks to Indian developers in Web3 and AI sectors.
Key takeaways
- 1TrapDoor malware campaign deployed 34+ malicious packages across npm, PyPI, and Crates targeting crypto and AI developers.
- 2Malware steals wallet data, SSH keys, GitHub tokens, cloud credentials and hijacks AI coding assistants like Claude and Cursor.
- 3Attack targets major wallets including Coinbase, Binance, Solana, MetaMask and uses AI-assisted iteration for rapid deployment.
Coins in this story
Why it matters
Indian Web3 and AI developers face direct credential theft risks affecting wallet security and cloud infrastructure. Supply chain attacks on development tools represent a systemic threat to the growing Indian crypto ecosystem, requiring vigilant package vetting.
Explore how AI Agents is shaping crypto markets — aggregated stories, leading coins, and weekly momentum.
Explore narrativeRelated stories
‘Developed ecosystem’ based on crypto has sprung up for AI agents: Report
Stablecoins became the default settlement layer for AI agents as crypto payment rails can handle sub-dollar transactions more efficiently, says a report from Keyrock....
Now You Can Buy Bitcoin, XRP and More in ChatGPT via MoonPay
OpenAI has integrated MoonPay's crypto purchasing capability into ChatGPT, allowing users to buy Bitcoin, XRP, and other cryptocurrencies directly within the chatbot. This partnership streamlines crypto acquisition for mainstream users. The move signals growing institutional acceptance of digital assets and expands retail accessibility. For Indian investors, this mainstream integration could drive adoption awareness, though regulatory clarity remains crucial for local participation in such global platforms.