34 Malicious Packages, 23 States, Zero Encryption: Supply-Chain Rot Hits US Small Businesses

🎉 Your Router Is a Sieve, and You're Paying for the Colander

34+ malicious packages dropped into npm, PyPI, and Crates.io — eth-security-auditor, prompt-engineering-toolkit — credential-theft payloads infecting developer toolchains across 23 US states. 🎉 That's the TrapDoor supply-chain campaign, hitting the exact pipelines small businesses depend on. The gateway router on your Ikea desk lacks encryption. Your traffic routes through South Korean cloud servers via a Houston ISP. Unencrypted. Because encryption costs compute. Meanwhile, the FCC waived foreign-router restrictions so more insecure hardware keeps shipping. Texas Parks and Wildlife just leaked 3,087,721 records — driver's licenses, passport numbers — via a compromised vendor's hunting license system. The supply chain is rotting from every angle. So: you'll spend $400 on a standing desk to protect your spine, but $15/month for a firewall is where you draw the line? 🤡

Anthony Spadafora published the obvious on July 30: weak network defenses are fueling cyberattacks on American small businesses. Groundbreaking. Meanwhile, those businesses route traffic through South Korean cloud servers while relying on Houston-based ISPs. The consumer-grade gateway routers proliferating across Texas living rooms? They lack encryption features — and the TrapDoor supply-chain attack, hitting npm, PyPI, and Crates.io between May 22–28, proved exactly how that plays out: 34+ malicious packages downloaded into developer toolchains that small businesses depend on, credential-theft payloads like eth-security-auditor and prompt-engineering-toolkit intercepting cloud tokens across 23 US states. Imagine buying a fire extinguisher that's just a plastic bottle with the word "FIRE" printed on it. Same energy.

The Home-Office House of Cards

The problem isn't the hacker. It's the hardware sitting on the Ikea desk.

Remote-work dependence turned every suburban home into a branch office. Continuous video conferencing means continuous exposure. A single-point failure in a $60 router disrupts an entire earnings stream. The vulnerability chain runs: flimsy router → unencrypted traffic → credential harvest → lateral movement into the small business's actual network. Spadafora's VPN testing across Tom's Guide exposed what the industry won't admit: commercialized security solutions have gaping holes, and vendor evaluations keep finding them because the holes are that big.

By mid-May 2026, the FBI and CISA issued urgent alerts about the TrapDoor campaign exploiting vulnerable developer tooling and the Nx Console extension — credential theft via Go-based implants, SSH key exfiltration, source-code exposure requiring device replacement, not just a patch. Meanwhile, the FCC granted waivers on June 3 and June 10 allowing foreign-made routers to keep shipping during chip shortages, temporarily easing supply-chain constraints but prolonging dependency on hardware that ships with vendor-default credentials and UPnP/WPS wide open. The Texas-Korean cloud pipeline still routes unencrypted traffic because encryption costs compute.

Zoom out. The editorial machine shifted to covering ergonomic desks alongside router hardening. People will spend $400 on a standing desk to protect their spine but balk at $15/month for a firewall that protects their livelihood. On June 19, the Texas Parks and Wildlife Department reported a data breach affecting 3,087,721 Texans — via a compromised vendor's hunting license system exposing driver's licenses, passport numbers, emails, phone numbers, and home addresses. The supply chain is rotting from every angle.

What Actually Changes

• Q3 2026: Bundled firewall-VPN packages from providers rise ~23% in SMB procurement pipelines. Surfshark's Dausos protocol launch and multi-year deals at ~$67.19 for a starter plan demonstrate the shift. Budgets expand toward mid-year. Necessity, not wisdom, drives adoption.
• Q4 2026: Expect 40% of Houston-based small enterprises to deploy some form of encrypted transport. The remaining 60% wait until they get nailed. ExpressVPN's post-quantum encryption and 3,000+ node expansion lower the barrier — but adoption still lags.
• By 2027: Cooperative ISP-level safeguards become the only scalable fix. Individual device hardening is a losing game when the gateway itself is the vulnerability.

The Real Gaps

Vendor assessment: Spadafora's evaluations keep surfacing the same problems. That's not bad reporting. That's a supply chain that sells insecurity as a feature. On May 23, Netgear issued a security advisory highlighting increased IoT attacks and the vulnerability of default passwords. The industry knows. It doesn't care.

Human behavior: Austin-based subscribers engage with router troubleshooting tips at high rates. They're anxious. They're also not deploying the fixes because the fixes require knowing what a DNS setting is. On May 27, multiple vendors advised changing Wi-Fi passwords every 3-6 months — a recommendation that assumes users remember where the admin panel is.

Institutional response: Minimal. ISPs still ship routers with vendor-default credentials. Manufacturers still prioritize cost over cryptographic readiness. Even Microsoft's August 1 TPM-attested KMS mandate — replacing software-only trust with hardware-backed authentication — addresses the enterprise KMS attack surface, not the root: the gateway device itself remains a hardened plastic shell with a bullseye painted on it.

The Cheeky Upshot

The system is designed to fail, then sell you the patch. Spadafora's routine coverage functions as an early-warning system for the non-technical, but a warning without a weapon is just anxiety. The real solution — bundled, ISP-enforced encryption baked into the hardware — won't arrive until the breach cascade becomes too expensive to ignore.

Until then, small businesses in Houston will keep paying for routers that are basically cardboard tubes with blinking lights. And the hackers will keep cashing checks written by neglect. 🎉