Polymarket Trap npm Dropper: C2 via package.json Homepage Field

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects Node.js processes engaging in suspicious behaviors related to supply chain or second-stage attacks. This includes executing scripts from hidden .peer/ directories, accessing specific staging script filenames, and performing DNS requests or network connections to the known malicious domain data-stream.space.