{"type":"bundle","id":"bundle--3e0eea7c-6e75-5728-98f4-715bacb6e29d","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--f03fe154-0ea0-5421-a011-39f8e38dc5f0","created":"2026-08-09T11:30:00.000Z","modified":"2026-08-09T11:20:00.000Z","name":"TrapDoor cross-ecosystem crypto stealer","description":"Socket documented a coordinated malicious-package campaign across npm, PyPI, and Crates.io that targeted developer credentials and wallets and included persistence through developer-tool instruction files.","aliases":["TrapDoor"],"first_seen":"2026-05-22T20:20:18.000Z","last_seen":"2026-05-24T00:00:00.000Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Socket: TrapDoor crypto stealer campaign","url":"https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates"}]}]}