Polymarket Trap Malicious npm Postinstall/Preinstall Hook Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of Node.js scripts associated with the Polymarket Trap / Trum3it npm supply chain campaign. This rule monitors process launch events for Node.js command lines that include suspicious lifecycle hook scripts (e.g., install-check.cjs, postinstall-run.js) often used by malicious packages to achieve initial code execution on developer machines.