TrapDoor Supply Chain Attack Spreads CredentialStealing Malware via npm PyPI and CratesIO

A new coordinated crossecosystem software supply chain attack campaign has targeted npm PyPI and Cratesio to distribute credentialstealing malware The campaign codenamed TrapDoor spans more than 34 malicious packages across over 384 versions The earliest activity was recorded on May 22 2026 at 820 pm UTC with new packages published to the ecosystems in waves from a cluster of