Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Threat Intelligence | TrapDoor Analysis: A Cross-Ecosystem Supply Chain Credential Theft Operation
Excerpt
Background On May 24, 2026, the security research team at Socket.dev disclosed a supply chain poisoning campaign spanning the npm, PyPI, and Crates.io ecosystems, named TrapDoor. The operation involved more than 34 malicious packages and a total of 384 published versions, targeting developers in the cryptocurrency, DeFi, Solana, AI, and security sectors. By leveraging each ecosystem’s native execution mechanisms — npm’s postinstall hooks, PyPI’s import entry points, and…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Attack Flow6 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://ddjidd564.github.io/defi-security-best-practices/config.json | High | Score 58/100 | First seen |
| URL | https://ddjidd564.github.io/defi-security-best-practices/priority_targets.json | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…