Polymarket Trap Transitive npm Sideload - node.exe Spawning cmd.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects malicious npm dependency sideloading where a node.exe process spawns cmd.exe from a path containing 'node_modules'. This rule specifically targets the behavior observed in the Polymarket Trap / wshu.net supply chain campaign, where indirect dependencies execute malicious scripts that bypass security restrictions by launching Windows command shells at runtime.