Polymarket Trap Infostealer: node.exe Spawning Host Recon Commands

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where a Node.js process (e.g., node.exe) spawns standard system reconnaissance binaries such as whoami, hostname, systeminfo, ipconfig, or ifconfig. This behavior is indicative of malicious activity, specifically infostealer campaigns (like the Polymarket Trap / Miasma) that leverage npm postinstall scripts or other Node.js execution patterns to gather host and environment information from developer machines.