Polymarket Trap: npm Dropper Script Spawning Child Process with Sensitive File Reads

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where JavaScript runtime processes (node, npm) execute specific peer-related or verification scripts and subsequently access sensitive system files or directories, such as SSH configurations, AWS credentials, or browser data, within a 5-minute window.