SlowMist said the TrapDoor supply chain attack spans npm, PyPI and Crates.io through more than 34 malicious packages and 384 versions. The campaign targets developers in crypto, DeFi, Solana, Sui/Move and AI by compromising software dependencies used in developer environments. SlowMist urged affected teams to immediately remove the malicious packages, rotate credentials and rebuild impacted systems from clean images, underscoring the risk of credential theft and broader environment compromise.