TrapDoor Attack Plants 34+ Malicious Packages in npm, PyPI,

The real target isn't a developer's wallet file — it's the workstation, where SSH keys, AWS credentials, GitHub tokens and live AI coding sessions all sit on the same machine.

CoinDesk