Polymarket npm Supply Chain: Malicious Lifecycle Scripts, C2 Beaconing, and Credential Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects malicious activity associated with npm supply chain compromise, including execution of known malicious npm lifecycle scripts, DNS queries to suspected C2 domains, and unauthorized access to sensitive developer credential files (such as .npmrc, .aws/credentials, and SSH keys) by Node.js processes.