Executive Summary
A coordinated supply chain attack, primarily attributed to the Trum3it GitHub actor and ten associated npm maintainer accounts, has been identified targeting DeFi developers. The campaign uses a fake Polymarket arbitrage bot as bait to lure victims into installing malicious npm dependencies. The attack utilizes four distinct delivery mechanisms: multi-stage droppers, direct script embedding, transitive side-loading, and a novel self-upgrade technique that bypasses static analysis by overwriting clean packages with malicious versions post-installation.
Technical analysis revealed that the campaign's core payload is an extensive JavaScript infostealer capable of harvesting crypto wallet vaults (MetaMask, Phantom, etc.), browser credentials, SSH keys, AWS secrets, and shell history. The operators share C2 infrastructure, including Vercel serverless endpoints and dedicated servers like log-taker[.]store, indicating a highly organized operation. The impact is severe for DeFi organizations, as compromised developer workstations provide a direct path to CI/CD pipelines and sensitive production environments.