Trum3it Polymarket Trap: npm Lifecycle Hook Spawning Shell or Downloader

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects instances where npm or node processes execute suspicious shell commands or scripts, often associated with software supply chain attacks. The rule looks for child processes like shell interpreters (sh, bash) or utilities (curl, wget, python) initiated by node/npm, combined with suspicious command-line patterns indicative of obfuscated execution or malicious package lifecycle scripts.