✍️We have released an in-depth technical analysis report on the #TrapDoor# cross-ecosystem supply chain credential theft campaign. TrapDoor was first disclosed by the @SocketSecurity on May 24. Subsequently, we conducted continuous threat hunting through our MistEye threat intelligence system and issued an early warning. The campaign spans npm, PyPI, and involving 34+ malicious packages and 384+ versions targeting developers in crypto, #DeFi#, #Solana#, #Sui#/Move, and #AI#. 🔍In this report, we selected three representative samples for detailed analysis: 🔹PyPI: git-config-sync (disguised as a Git configuration synchronization tool) 🔹npm: token-usage-tracker (disguised as a token usage tracking tool) 🔹 sui-framework-helpers (disguised as a Sui Move development helper library) For each sample, we fully reconstructed the attack chain — from the entry-point trigger mechanisms (postinstall / / sensitive data collection scope, encryption and encoding methods, to the exfiltration channels and remote control infrastructure ( GitHub Gists, Special thanks to @SocketSecurity for their outstanding initial research and disclosure of the TrapDoor campaign. Salute! 👏 📖 Full technical analysis :