Polymarket Trap npm Package C2 Config Via package.json Homepage Field

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects node.exe and script execution patterns associated with the Polymarket Trap supply chain attack. The rule monitors for the usage of specific environment variables (e.g., DFC_SYNC_CONFIG), operator tags (e.g., piterpan), and C2 domain connections that indicate a malicious attempt to extract configuration data from an NPM package.json file.