Polymarket Trap npm Scope Squat - @withgoogle/stitch-sdk and Typosquats

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects the execution of node.exe or npm.cmd where the command-line arguments include specific indicators associated with suspicious third-party libraries, typosquatted packages, or known malicious domains. These indicators often point to unauthorized external dependencies or potential supply chain attack patterns in JavaScript-based environments.