Polymarket Trap npm stealer collecting Claude Code and Docker credentials

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects Node.js processes spawning from common command-line shells (npm, cmd, bash) and accessing sensitive credential directories, such as '.claude' or Docker 'config.json'. This behavior is indicative of credential theft or unauthorized access attempts often associated with malicious npm packages or supply chain attacks.