Polymarket Trap: Malicious npm Self-Upgrade Overwriting node_modules Post-Install

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects anomalous behaviors associated with malicious npm package self-upgrades, where node.exe modifies its own source files within node_modules or spawns npm pack commands to replace existing dependencies with malicious versions.