Polymarket Trap Transitive Dependency node.exe Outbound to wshu.net C2

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects outbound network connections from node.exe or npm related processes to domains associated with the Polymarket Trap supply chain attack. This detection highlights the malicious behavior of compromised npm packages that initiate C2 communication at import time, bypassing standard postinstall security scripts.