Poisoned Pipeline / Incidents / AS151

AS151 · 2026-05

TrapDoor crypto stealer across 34 packages

npmPyPIcrates.io

Socket: TrapDoor crypto-stealer supply chain hit 34 packages and
hundreds of versions across npm, PyPI, and crates.io.

Mapped techniques

• T0109 Publish malicious artifact
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates