Researchers at Socket Security just discovered 34 malicious packages targeting developers building on Aptos, Sui, and Solana. The malware is called TrapDoor. It steals crypto wallet credentials, SSH keys, cloud credentials, browser data, and environment variables.
If you installed one of these packages, your wallet is already at risk, even if nothing has happened yet.
Supply chain attacks targeting crypto developers follow a predictable pattern:
Attacker publishes malicious packages to npm or PyPI with names that closely mirror legitimate libraries
Developer installs the package. It is often automated via a dependency update
TrapDoor silently executes on install, harvesting credentials from the local environment
Stolen data, including wallet seed phrases, private keys, and session cookies is exfiltrated to attacker infrastructure
Attacker waits sometimes days, sometimes weeks and then drains the wallet when the timing is right.
The theft of your wallet doesn't happen the moment you install the package. It happens later after the attacker has time to act. That gap is where monitoring matters.
Most developers check their wallet immediately after a suspected compromise. If nothing is missing, they assume they're safe. That's the wrong assumption.
Infostealer malware like TrapDoor doesn't just steal credentials once. It establishes persistence. Browser-saved passwords, autofill data, and session cookies are harvested continuously. An attacker holding your Phantom or Backpack wallet seed phrase will wait for the right moment: a large deposit, a token unlock, a liquidity event.
Your wallet balance today tells you nothing about whether your credentials are already in someone else's hands.
1. Check if your email appeared in an infostealer log
Infostealer logs are bundles of stolen credentials harvested from infected machines that are actively traded on criminal Telegram channels and dark web markets. If your developer email appears in one of these logs, your credentials from that machine are compromised regardless of whether your wallet looks fine today.
You can check this with RelayShield's /infostealer command. It screens your email against known malware credential databases and alerts you if your data appears.
2. Audit your browser extensions
TrapDoor harvests browser data. Malicious browser extensions are the most common persistence mechanism for infostealer malware after initial infection. They quietly re-harvest credentials on every login. Review every extension you have installed and remove anything you don't actively use or can't verify.
RelayShield's /extensions command walks you through a step-by-step browser extension audit across Chrome, Firefox, and Brave.
3. Move assets to a fresh wallet if you installed any affected packages
If you installed packages from the affected ecosystems in the last 30 days and can't confirm they were clean, treat your current wallet as compromised. Generate a new wallet on a clean device and transfer your assets before an attacker acts.
TrapDoor is not unique. Supply chain attacks targeting crypto developers have become systematic. Attackers know that developers have higher wallet balances, lower security hygiene around development environments, and more exposure through dependency installation than typical users.
The attack surface for a Solana or Aptos developer isn't just their wallet. It's every package they install, every browser they use, every credential saved to autofill. Protecting the wallet address alone misses most of the attack chain.
RelayShield's Crypto Shield tier monitors the full attack chain that leads to wallet theft:
Infostealer credential exposure: Checks your email against malware log databases
SIM swap detection: Alerts you if your phone number is being ported, the first step in exchange account takeover
Wallet monitoring: Real-time alerts on every inbound and outbound transfer with counterparty risk screening
Breach monitoring: Continuous monitoring across all known breach databases
Alerts arrive via Telegram. No app, no dashboard, no friction.
If you're building on Solana, Aptos, or Sui or holding meaningful assets on any chain. the TrapDoor campaign is a reminder that on-chain monitoring alone isn't enough. The attack starts off-chain, in your development environment.
Check your exposure: search RelayShield on Telegram and run /infostealer with your developer email.
RelayShield was founded by a 25-year telecom security professional.