Polymarket Trap npm postinstall malicious script execution via node.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects execution of potentially malicious npm lifecycle scripts (preinstall/postinstall) associated with the Polymarket Trap supply chain campaign. The rule monitors node.exe spawning specific known-malicious scripts or executing shell commands via cmd.exe, often related to attacker-controlled dependency packages.