Cross-Ecosystem Poisoning: Dissecting the TrapDoor Campaign (npm, PyPI, Crates.io)

We flagged this on our staging environment yesterday. The npm packages were using obfuscated JavaScript to trigger reverse shells. We've locked down our registries to only allow specific domains, but it's a game of whack-a-mole.

I recommend running npm audit with the force flag, but honestly, manual review of the package. diff is the only way to be 100% sure right now.

Great query, thanks for sharing. From a SOC perspective, we're seeing the C2 traffic attempt to blend in with legitimate HTTPS traffic. The malware seems to be targeting AWS and GitHub credentials specifically.

If you use Defender for Endpoint, keep an eye on AlertTitle containing "Suspicious PowerShell command line" coinciding with those installs.

This reinforces why we moved to an internal air-gapped proxy for PyPI. The blast radius is contained if a malicious package slips through, provided we vet the imports before mirroring.

It's painful for the devs to wait for approvals, but incidents like TrapDoor justify the overhead.

Good insight, Marcus. To complement network-based detection, we're focusing on runtime telemetry. Many of these packages rely on post-install scripts. We recently implemented a KQL rule to flag suspicious child processes spawned by npm or pip:

DeviceProcessEvents
| where InitiatingProcessFileName in ("npm.exe", "pip.exe")
| where ProcessFileName in ("powershell.exe", "cmd.exe", "curl.exe")

Solid points on the network side. Don't forget retrospective supply chain hygiene. Since these packages target specific ecosystems, automated SBOM validation in CI/CD is vital to catch version drift. If you need to quickly audit existing environments, we've been extracting hashes from lockfiles and cross-referencing them with OSINT feeds.

Here's a quick snippet to pull integrity hashes from an npm lock file for verification:

const fs = require('fs');
const pkg = JSON.parse(fs.readFileSync('package-lock.'));
Object.values(pkg.packages).forEach(p => {
    if (p.integrity) console.log(`${p.name}: ${p.integrity}`);
});

We’ve adopted a policy-as-code approach to strictly enforce provenance requirements across our pipelines. Using Open Policy Agent (OPA), we block builds if dependencies lack valid Sigstore attestation. This governance layer prevents unsigned packages from ever reaching our runtime environments, ensuring trust regardless of scanner evasion.

rego package main deny[msg] { not input.packages[i].sigstore_verified msg := sprintf("Package %s lacks provenance", [input.packages[i].name]) }

Validating lockfile integrity is critical here since scanners are lagging behind these waves. We’re enforcing strict hash checks in our CI pipeline to ensure the tarball matches the registry entry, preventing version confusion. If you're hunting retrospectively, this Python snippet helps quickly scan local environments for the specific naming conventions or suspicious metadata associated with this campaign:

import pkg_resources
import os

for dist in pkg_resources.working_set:
    # Check against known malicious patterns or names
    if 'trapdoor' in dist.project_name.lower():
        print(f"Suspicious package detected at: {dist.location}")