Polymarket Trap Trum3it Fake Arbitrage Bot npm Package Installation Lure

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects network proxy activity associated with the 'Polymarket Trap' supply chain attack, where developers are lured into cloning a fake arbitrage bot repository or fetching malicious npm packages from the wshu.net domain. The rule monitors for access to known malicious repositories (Trum3it/polymarket-arbitrage-bot) and malicious dependencies (clob-client-math).