TrapDoor Supply Chain Attack: Credential-Stealing Malware in npm, PyPI, and Crates.io

---
title: TrapDoor - Suspicious Child Process of Package Managers
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects package managers (npm, pip, cargo) spawning shells or network tools, a common TTP in supply chain attacks like TrapDoor.
references:
  - https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html
author: Security Arsenal
date: 2026/05/23
tags:
  - attack.execution
  - attack.t1059.001
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\npm.exe'
      - '\npm.cmd'
      - '\node.exe'
      - '\pip.exe'
      - '\pip3.exe'
      - '\python.exe'
      - '\cargo.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\bash.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate build scripts that require post-install configuration (rare)
level: high
---
title: TrapDoor - Linux Package Manager Spawning Shell
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects npm, pip, or cargo on Linux spawning a shell or curl, indicative of malicious postinstall scripts.
references:
  - https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html
author: Security Arsenal
date: 2026/05/23
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentProcessName|endswith:
      - 'npm'
      - 'pip'
      - 'pip3'
      - 'cargo'
  selection_child:
    ProcessName|endswith:
      - 'sh'
      - 'bash'
      - 'curl'
      - 'wget'
      - 'python'
      - 'node'
  condition: all of selection_*
falsepositives:
  - Developer build scripts requiring environment setup
level: medium
---
title: TrapDoor - Credential File Access by Dev Tool
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects known package manager binaries accessing sensitive credential files on disk.
references:
  - https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html
author: Security Arsenal
date: 2026/05/23
tags:
  - attack.collection
  - attack.t1005
  - attack.credential_access
logsource:
  category: file_access
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
      - '\python.exe'
      - '\cargo.exe'
    TargetFilename|contains:
      - '\.aws\credentials'
      - '\.aws\config'
      - '\.npmrc'
      - '\.gitconfig'
  condition: selection
falsepositives:
  - Legitimate AWS SDK or Git configuration operations by the user
level: high


**KQL (Microsoft Sentinel / Defender)**

let PackageManagers = dynamic(["npm.exe", "node.exe", "pip.exe", "pip3.exe", "python.exe", "cargo.exe"]);
let SuspiciousTools = dynamic(["powershell.exe", "cmd.exe", "curl.exe", "wget.exe", "bash.exe"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ (PackageManagers) or InitiatingProcessFileName in~ (PackageManagers)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where FileName in~ (SuspiciousTools)
) on $left.ProcessId == $right.InitiatingProcessId
| project Timestamp, DeviceName, AccountName, ParentProcess=FileName, ChildProcess=FileName1, ParentCommandLine=ProcessCommandLine, ChildCommandLine=ProcessCommandLine1


**Velociraptor VQL**

-- Hunt for package managers spawning suspicious shells
SELECT Parent.Pid AS ParentPid, Parent.Name AS ParentName, Child.Name AS ChildName, Child.Cmdline AS ChildCmdline, Child.StartTime
FROM pslist()
LEFT JOIN pslist() AS Parent ON Child.Ppid = Parent.Pid
WHERE Parent.Name IN ('npm', 'node', 'pip', 'pip3', 'python', 'python3', 'cargo')
  AND Child.Name IN ('sh', 'bash', 'powershell', 'pwsh', 'curl', 'wget')
  AND Child.StartTime > now() - 7 * 24 * 3600  -- Last 7 days


**Remediation Script (Bash)**

#!/bin/bash

# TrapDoor Audit Script
# Checks for recently modified packages in user-local directories

echo "[*] Auditing for TrapDoor malicious packages..."

# Define scope
TIMESTAMP=$(date -d '2026-05-22' +%s)
CURRENT_TIME=$(date +%s)

# Function to check for recently modified suspicious files
audit_directory() {
    local dir="$1"
    if [ -d "$dir" ]; then
        echo "[+] Checking $dir for modifications since May 22, 2026..."
        # Find files touched in the last 5 days (approx) to catch recent activity
        find "$dir" -type f -mtime -5 \( -name "package." -o -name "setup.py" -o -name "Cargo.toml" \) -exec ls -la {} \; 2>/dev/null
    fi
}

# Check user-local python packages
audit_directory "$HOME/.local/lib/python*/site-packages"

# Check npm global packages
audit_directory "$HOME/.npm/_logs"
# Check global node_modules (common locations)
audit_directory "/usr/local/lib/node_modules"
audit_directory "$HOME/node_modules"

# Check Cargo registry
audit_directory "$HOME/.cargo/registry"

# Check for suspicious environment variables often used in these attacks
if [ -n "$NODE_OPTIONS" ]; then
    echo "[!] WARNING: NODE_OPTIONS is set: $NODE_OPTIONS"
fi

echo "[*] Audit complete. Review findings for unknown or typosquatted packages."