Polymarket Trap: npm node.exe harvesting AWS and developer credentials

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects unauthorized access (creation, modification, renaming, or deletion) to sensitive local credential files by the Node.js runtime process (node.exe/node). This behavior is indicative of infostealers, specifically noted in the Miasma/MYRA activity associated with the Polymarket Trap campaign, where malicious packages attempt to exfiltrate AWS, SSH, NPM, Python, Docker, and GPG credentials.