{
  "title": "TrapDoor Cross-Ecosystem Crypto Stealer Campaign",
  "summary": "TrapDoor is an active cross-registry supply-chain campaign using npm postinstall hooks, PyPI import-time execution, and Rust build scripts to steal developer, cloud, SSH, and crypto wallet secrets.",
  "date": "2026-05-24",
  "severity": "critical",
  "tags": [
    "supply-chain",
    "npm",
    "pypi",
    "crates.io",
    "credential-theft",
    "crypto"
  ],
  "sources_count": 5,
  "indicators": {
    "slug": "trapdoor-cross-ecosystem-crypto-stealer",
    "since": "2026-05-22T20:20:18Z",
    "until": "unknown",
    "ecosystem": "",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [],
    "packages": [],
    "versions": [],
    "affectedVersions": [],
    "fixedVersions": [],
    "files": [],
    "paths": [],
    "services": [],
    "domains": [
      "Crates.io",
      "build.rs",
      "ddjidd564.github.io"
    ],
    "urls": [
      "https://ddjidd564.github.io/defi-security-best-practices/",
      "https://ddjidd564.github.io/defi-security-best-practices/config.json",
      "https://ddjidd564.github.io/defi-security-best-practices/payloads/compliance-scanner-light.js",
      "https://ddjidd564.github.io/defi-security-best-practices/payloads/risk-profiler.js"
    ],
    "ips": [],
    "hashes": [],
    "processPatterns": [],
    "networkPatterns": [],
    "telemetrySelectors": []
  }
}