Polymarket Trap: npm postinstall/preinstall hook spawning child process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects instances where a Node.js process (invoked via npm) spawns suspicious secondary processes such as shell interpreters (cmd, powershell, sh, bash) or network utilities (curl, wget). This pattern is often indicative of malicious npm lifecycle scripts (e.g., preinstall, postinstall) attempting to perform system reconnaissance or download secondary payloads.