Malicious code in polymarket-ai-agent (npm)
A coordinated supply-chain attack published 9 malicious npm packages under maintainer `polymarketdev` on 2026-05-20, masquerading as Polymarket CLOB trading tools. The packages exfiltrate Ethereum private keys via postinstall hooks to a Cloudflare Worker C2 endpoint, with adaptive evasion for CI/CD scanners.
- Disclosed
- Last updated
- Blast radius
- Developers using any of the 9 affected npm packages; Ethereum wallet holders whose private keys were exfiltrated; CI/CD pipelines running package installation.
- Attack vectors
- Affected entities
- polymarket-ai-agentPart of coordinated 9-package attack published 2026-05-20
On 2026-05-20 between 23:30Z and 23:32Z, nine npm packages were published by the GitHub actor texsellix (maintainer polymarketdev) in a coordinated attack. All packages masqueraded as legitimate Polymarket CLOB trading tools while implementing a sophisticated private key exfiltration mechanism.
The attack employed a multi-stage postinstall hook (scripts/postinstall.mjs) with adaptive behavior: on non-interactive shells (typical in CI/CD), it prints "polybot installed" and exits silently to evade automated scanning. On interactive terminals, it displays a masked readline prompt soliciting the wallet private key. Additionally, the malware passively reads .env files in the current working directory and extracts the PRIVATE_KEY environment variable without user interaction.
Exfiltrated data was POSTed as plain JSON to https://polymarketbot.polymarketdev.workers.dev/v1/wallets/keys, with device fingerprinting via the x-polybot-device header. Local persistence was established via ~/.polybot/ containing device identifiers and wallet fingerprints. All 9 packages shipped an identical 711 KB dist/index.js file (SHA-256 e01b85c1437085a519217338fe4ee5ed7858c28a10f8c1477b2f18...), indicating a single coordinated campaign.
The attack was disclosed via GitHub Advisory GHSA-cpc2-2h86-m44p on 2026-07-27.
Indicators of compromise
- Domains
- polymarketbot.polymarketdev.workers.dev
- Hashes
- e01b85c1437085a519217338fe4ee5ed7858c28a10f8c1477b2f18
Remediation
- Immediately revoke any Ethereum private keys that may have been exposed through installation of polymarket-ai-agent or related packages from this maintainer
- Audit npm package installation logs and CI/CD pipeline logs for any execution of these packages between 2026-05-20 and the time of remediation
- Remove the malicious packages and all dependencies; reinstall from trusted sources only
- Rotate all environment variables and secrets that may have been present in .env files during package installation
- Monitor the C2 endpoint (polymarketbot.polymarketdev.workers.dev) for any ongoing exfiltration attempts
- Review npm account security for any accounts that installed these packages and reset credentials if necessary
Sources
- GitHub Advisory GHSA-cpc2-2h86-m44p · GitHub Advisory Database
Cite this entry
"Malicious code in polymarket-ai-agent (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed May 20, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-polymarket-ai-agent-npm-tmujua
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @antv/g-webgl-compute (npm)
The npm account `atool` was compromised and used to publish 631 malicious versions across 314 npm packages, including @antv/g-webgl-compute, as part of the "Mini Shai-Hulud" supply chain attack campaign. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit - containedcritical
Malicious code in @antv/g6-extension-3d (npm)
A threat actor compromised the npm account `atool` and published 631 malicious versions across 314 npm packages, including @antv/g6-extension-3d, in a 22-minute automated burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit - containedcritical
Malicious code in @antv/gi-assets-basic (npm)
A threat actor compromised the npm account 'atool' and published 631 malicious versions across 314 npm packages, including @antv/gi-assets-basic, in an automated 22-minute burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit - activecritical
Malicious code in @antv/gi-assets-graphscope (npm)
A threat actor compromised the npm account 'atool' and published 631 malicious versions across 314 npm packages in a 22-minute automated burst, including @antv/gi-assets-graphscope. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.
npmOtherAccount takeoverCompromised packageMalicious commit