Polymarket Trap: npm Node.js Process Reads Docker or Cloud Credentials (T1552)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects unauthorized access to sensitive credential files (Docker, AWS, npm, PyPI, GCloud) by Node.js processes, specifically when those processes are triggered by common npm lifecycle scripts like preinstall, postinstall, or peer dependency scripts. This is a common pattern observed in supply chain attacks involving malicious npm packages.