Polymarket Trap npm Infostealer node.exe Reading SSH Private Keys

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects node.exe (Node.js runtime) process initiating file read operations on sensitive files such as SSH keys, AWS credentials, Docker configuration files, GPG keyrings, or package manager configuration files (npmrc/pypirc). This behavior is characteristic of malicious npm packages or infostealers attempting to exfiltrate developer credentials, as observed in the Polymarket Trap supply chain campaign.