Typosquatted thirdweb/rainbowkit npm Packages Installing log-taker Infostealer

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the installation and execution of malicious typosquatted npm packages associated with the Polymarket Trap campaign. It monitors for the creation of specific directory names within node_modules, npm install commands referencing these package names, and network activity or DNS lookups to 'log-taker' infrastructure from Node.js processes.