Polymarket Trap Infostealer Node.js Reading AWS and Developer Credentials

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects Node.js processes accessing sensitive configuration and credential files such as AWS credentials, .npmrc tokens, SSH keys, and Docker configurations. This behavior is consistent with infostealer activity, including malicious supply chain attacks designed to harvest developer secrets from local filesystems.