Polymarket Trap Infostealer Harvesting SSH Keys and AWS Secrets from Developer Env

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the Polymarket Trap / Miasma JavaScript-based infostealer attempting to access sensitive configuration files and credentials (SSH keys, AWS credentials, .npmrc, .pypirc, Docker config, and GPG keys) from a developer's workstation using node.js-related runtimes.