Polymarket Trap: npm Typosquat and Scope-Squat Package Postinstall Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects potential supply chain compromise involving typosquatted npm packages. It monitors for the execution of npm packages with names closely resembling legitimate libraries (e.g., 'thirdweb', 'rainbownkit'), followed by suspicious post-install scripts that attempt to initiate network connections to known malicious domains or modify sensitive files.