Polymarket Trap: node.exe AWS Credential and npm Token Theft

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects node.exe processes accessing sensitive AWS configuration files (credentials, config), .npmrc files, or suspicious data parsing utilities, indicative of the Polymarket Trap npm infostealer attempting to exfiltrate cloud credentials and tokens from developer workstations.