Polymarket Trap npm Self-Upgrade: node.exe Spawning npm pack --pack-destination Post-Install

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects anomalous self-upgrade behavior in npm packages where a node process spawns child processes using npm pack or specific command-line arguments to overwrite installed package files. This pattern is associated with malicious supply chain activity, specifically seen in the wshu.net campaign where packages download and replace their own contents at runtime.