Polymarket Trap Miasma Dropper node.exe Executing test.js via npm Postinstall

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects node.exe executing 'test.js' as a child process of NPM lifecycle scripts (postinstall/preinstall). This behavior is characteristic of malicious NPM packages like 'ts-bn-lint' and 'log-taker' used in the Polymarket Trap campaign to execute an embedded infostealer payload.