34 Malicious Packages Steal Cloud Keys, Wallets, and SSH Credentials

Hackers are actively abusing open-source ecosystems to steal sensitive developer data through a large-scale supply chain attack dubbed “TrapDoor,”.

The campaign spans npm, PyPI, and Crates.io, leveraging 34 malicious packages and 384 versions to target developers working in cryptocurrency, DeFi, AI, and cloud environments.

The attackers weaponized legitimate package installation and build mechanisms to silently execute malicious code. By abusing npm’s postinstall scripts, Python’s import behavior, and Rust’s build.rs compilation phase, the malware automatically activates during installation or project builds without requiring user interaction.

This allows threat actors to harvest high-value assets such as SSH keys, cloud credentials, API tokens, and cryptocurrency wallets.

Security monitoring from SlowMist’s MistEye platform confirmed widespread activity across all three ecosystems. Researchers analyzed three representative malicious packages: git-config-sync (PyPI), token-usage-tracker (npm), and sui-framework-helpers (Crates.io).

Each package was disguised as a legitimate developer tool but contained hidden data-stealing logic.

The Python package git-config-sync executes malicious code as soon as it is imported. It scans sensitive directories such as .ssh, .aws, .docker, and .kube for credentials using regex patterns targeting AWS keys, GitHub tokens, private keys, and passwords.

The stolen data is then sent to attacker-controlled endpoints retrieved from a remote configuration hosted on GitHub Pages. Notably, TLS verification is disabled, allowing attackers to intercept or manipulate traffic more easily.

34 Malicious Packages Steal Cloud Keys

The npm package token-usage-tracker is the most advanced component of the campaign. It runs a background process after installation and continuously collects sensitive data, including browser credentials, cloud configs, shell histories, and cryptocurrency wallets.

It also attempts to crack weakly protected Ethereum keystores. The malware encrypts stolen data using Fernet encryption before exfiltrating it via webhook endpoints or GitHub Gist.

Beyond data theft, this npm package introduces persistence and propagation mechanisms. It modifies shell configuration files, injects malicious Git hooks, and even poisons AI development environments by inserting hidden instructions into files like .cursorrules and CLAUDE.md.

These instructions can influence AI coding assistants to execute malicious commands, enabling further spread across repositories and developer environments.

The Rust package sui-framework-helpers executes during the build process via build.rs. It targets blockchain wallet files from Sui, Solana, and Aptos environments, encodes the data using XOR obfuscation, and uploads it to public GitHub Gists.

Unlike the npm and Python variants, it lacks clear shared infrastructure, and its link to the broader campaign is based on external attribution.

A key aspect of the TrapDoor campaign is its use of trusted platforms like GitHub Pages, raw.githubusercontent.com, and webhook.site for data exfiltration.

These services are commonly whitelisted in enterprise environments, allowing malicious traffic to blend in with legitimate developer activity and evade detection.

The attack chain across all samples follows a consistent pattern: execution trigger during install or build, credential harvesting from local environments, and data exfiltration through trusted channels.

However, the npm variant stands out due to its ability to persist, propagate, and even execute remote commands, significantly increasing its impact.

Security experts warn that this campaign highlights the growing sophistication of software supply chain attacks. Developers are urged to audit dependencies, use lockfiles, monitor outbound traffic, and rely on security tools that can detect suspicious package behavior before installation.

IOCs

Domain

ddjidd564[.]github[.]io

URLs

https[:]//ddjidd564[.]github[.]io/defi-security-best-practices/config.json
https[:]//raw[.]githubusercontent[.]com/ddjidd564/defi-security-best-practices/main/config.json
https[:]//ddjidd564[.]github[.]io/defi-security-best-practices/priority_targets.json
https[:]//raw[.]githubusercontent[.]com/ddjidd564/defi-security-best-practices/gh-pages/scan-bundled.js
https[:]//raw[.]githubusercontent[.]com/ddjidd564/defi-security-best-practices/gh-pages/scan.js
https[:]//webhook[.]site/2ada14c8-00f6-43ce-9ad6-f5dc15952246
https[:]//webhook[.]site/7513bf3d-7092-4739-bf15-a8f779a75546
https[:]//webhook[.]site/d1652693-2eb8-4281-b9e8-cffff36da2f8

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.