384 versions. Wrong supply chain problem.
TrapDoor campaign spans npm, PyPI, and Crates.io, distributing credential-stealing malware. The earliest activity was recorded on May 22, 2026, at 8:20 p.m. UTC. Technical mechanics involve publishing malicious packages to the ecosystems in waves.
What everyone reads as a package problem is actually a third-party assurance failure. 30% of breaches involved third-party involvement in 2024, doubling from 15% in 2023 (Verizon DBIR 2025). Geopolitically, this echoes historical patterns of state-nexus actors exploiting trust in open-source ecosystems.
The defensive math: -> Review software supply chain risk management strategies within the next 6 weeks -> Implement active monitoring for suspicious package updates and versions, aiming for a 95% detection rate -> Reduce mean time to remediate leaked secrets in package repositories to under 30 days
Can your team prevent a TrapDoor-like infection by auditing package dependencies this quarter?