TrapDoor Supply Chain Campaign Targets npm, PyPI, and Crates.io to Poison AI Coding Agents
4 distinct publishers across 6 articles (some outlets filed more than once).
Ownership mix: Other: 6
4 publishers · 6 articles · switch to 1-minute for disagreement and framing.
What happened
🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.io. Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly…
Why the coverage differs
AI-assisted comparison · labeled · generated May 25, 2026, 12:35 PM · not a verdict
A supply chain attack known as "TrapDoor" has targeted package repositories npm, PyPI, and Crates.io, affecting 36 malicious packages primarily aimed at developers in the crypto, DeFi, AI, and security sectors. The attack reportedly involves the poisoning of AI coding assistants, which could lead to the dissemination of compromised code.
Coverage of the event is largely consistent across outlets, with most emphasizing the technical aspects of the attack and its implications for developers. However, some sources, like Socket, provide more detail on the specific types of packages affected and the potential risks to various sectors, while others, such as r/javascript, focus more on the AI-assistant poisoning angle. Overall, there is a lack of significant framing differences across the cluster, as most outlets maintain a neutral tone.
Comparison summary
AI-assisted · Cerebras / Llama · May 25, 2026, 12:35 PM · inspect sources below rather than trusting this alone
A supply chain attack known as "TrapDoor" has targeted package repositories npm, PyPI, and Crates.io, affecting 36 malicious packages primarily aimed at developers in the crypto, DeFi, AI, and security sectors. The attack reportedly involves the poisoning of AI coding assistants, which could lead to the dissemination of compromised code.
Coverage of the event is largely consistent across outlets, with most emphasizing the technical aspects of the attack and its implications for developers. However, some sources, like Socket, provide more detail on the specific types of packages affected and the potential risks to various sectors, while others, such as r/javascript, focus more on the AI-assistant poisoning angle. Overall, there is a lack of significant framing differences across the cluster, as most outlets maintain a neutral tone.
What remains unaddressed in this coverage is the response from the affected platforms or any measures being taken to mitigate the attack's impact. This absence leaves a gap in understanding how the repositories plan to protect their users and secure their systems against future threats.
Report timeline
Oldest → newest among clustered members. Gaps may mean delayed pickup, not silence.
-
May 24, 2026, 9:54 AMX (formerly Twitter) · CenterActive supply chain attack across NPM, PyPI, and Crates. io
-
May 24, 2026, 9:59 AM
-
May 24, 2026, 10:18 AM
-
May 24, 2026, 11:34 AM
-
May 24, 2026, 2:10 PMSocket · CenterTrapDoor supply chain attack hits PyPI, NPM, and crates.io
-
May 25, 2026, 5:30 AM
Coverage by perspective
Perspective labels are external consensus ratings (AllSides / Ad Fontes / MBFC-style), not WeSearch truth scores. Center is not automatically more accurate.
Center · 6
Headline framing
Vocabulary fingerprints · not a political endorsement
The headlines discuss a supply-chain attack named TrapDoor affecting npm, PyPI, and Crates.io, with a focus on its implications and targeting.
Bias/ownership: published methodology on source profiles · AI text always labeled · no reader paywall · no engagement ranking of news · transparency · contribute Ws · home