Malicious npm Postinstall/Preinstall Lifecycle Script Spawning Child Processes (Polymarket Trap)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects suspicious activities associated with malicious npm package installations, including Node.js spawning shells during lifecycle hooks (preinstall, postinstall), connections to known command-and-control (C2) domains used in software supply chain campaigns, and the creation of artifacts within the node_modules directory.