MSC-2026-5764

"TrapDoor" campaign — 34+ malicious packages across npm, PyPI, and Crates.io targeting crypto and AI developers. It uses ecosystem-specific delivery npm postinstall hooks, Python remote JS execution, Rust build scripts to steal credentials, wallets, and SSH keys. Notably, it also plants...