Malicious code in polymarket-auto-trade (npm)
A coordinated supply-chain attack published 9 malicious npm packages under the polymarketdev maintainer on 2026-05-20, masquerading as Polymarket CLOB trading tools. The packages exfiltrate Ethereum private keys via postinstall hooks to a Cloudflare Worker C2 endpoint, with adaptive evasion for CI/CD scanners.
- Disclosed
- Last updated
- Blast radius
- All users who installed any of the 9 malicious packages and ran them in interactive shells or with PRIVATE_KEY environment variables exposed; Ethereum wallets associated with extracted private keys.
- Ecosystems
- Attack vectors
- Affected entities
- polymarket-auto-tradePart of coordinated 9-package attack by maintainer polymarketdev (GitHub actor texsellix)
On 2026-05-20 at approximately 23:30–23:32 UTC, a coordinated supply-chain attack published 9 malicious npm packages under the maintainer account polymarketdev (GitHub actor texsellix). All packages masqueraded as legitimate Polymarket CLOB trading tools while implementing a sophisticated private key exfiltration scheme.
The attack employed a multi-stage postinstall hook (scripts/postinstall.mjs) with adaptive behavior: on non-interactive shells (typical for CI/CD scanners), it prints "polybot installed" and exits silently to evade detection. In interactive environments, it displays a masked readline prompt soliciting the wallet private key. Additionally, the malware passively reads .env files in the current working directory and extracts the PRIVATE_KEY environment variable without user interaction, allowing silent compromise of developers who store credentials in environment files.
The malware establishes local persistence by creating ~/.polybot/ (mode 0700) containing device.json (UUID + creation timestamp) and wallets.json (Ethereum address + keccak256 fingerprint + timestamp). Exfiltrated data is POSTed as plain JSON to the C2 endpoint https://polymarketbot.polymarketdev.workers.dev/v1/wallets/keys with device fingerprinting headers.
All 9 packages shipped an identical dist/index.js (711 KB, SHA-256 e01b85c1437085a519217338fe4ee5ed7858c28a10f8c1477b2f...), indicating a single malicious codebase deployed across multiple package names.
Indicators of compromise
- Packages
- polymarket-auto-trade
- Domains
- polymarketbot.polymarketdev.workers.dev
Remediation
- Immediately revoke any Ethereum private keys that may have been exposed through installation of polymarket-auto-trade or related packages from the polymarketdev maintainer
- Audit npm install logs and CI/CD pipeline logs for execution of packages published by polymarketdev on 2026-05-20
- Remove any `.polybot/` directories from affected systems
- Rotate all environment variables and secrets that may have been stored in .env files on systems where these packages were installed
- Monitor associated Ethereum addresses for unauthorized transactions
- Report compromised accounts and private keys to relevant blockchain security services
- Review npm audit logs and consider using npm provenance verification for future package installations
Sources
- GitHub Advisory GHSA-82rv-jcgv-p6x5 · GitHub Advisory Database
Cite this entry
"Malicious code in polymarket-auto-trade (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed May 20, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-polymarket-auto-trade-npm-ibli4g
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malicious code in @cap-js/openapi (npm)
The npm package @cap-js/openapi was compromised and found to contain malicious code. The package steals credentials and propagates them to other packages it has access to, with persistence mechanisms. This is attributed to the "Mini Shai-Hulud is back" worm campaign by the TeamPCP threat actor.
npmCompromised packageMalicious maintainer - containedhigh
Microsoft links Mastra AI supply chain attack to North Korean hackers
Microsoft attributed a Mastra AI supply chain attack that compromised over 140 npm packages to North Korean hacking group Sapphire Sleet (BlueNoroff). The attack targeted the npm ecosystem and AI development infrastructure.
UNC1069npmAI agents & skillsCompromised packageMalicious maintainer - activecritical
Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
On June 17, 2026, an attacker compromised the @mastra npm organization and injected easy-day-js, a typosquat of the popular dayjs library, as a dependency across 140+ packages. The malicious package contained an obfuscated postinstall dropper that downloaded and executed a second-stage payload from attacker-controlled servers before self-deleting. The affected packages had a combined weekly download count exceeding 1.1 million.
npmCompromised packageTyposquattingMalicious maintainer - containedcritical
Malicious code in polymarket-trader (npm)
A coordinated supply-chain attack published 9 malicious npm packages by maintainer polymarketdev on 2026-05-20, masquerading as Polymarket CLOB trading tools. The packages exfiltrate Ethereum private keys via postinstall hooks to a Cloudflare Worker C2 endpoint, with evasion techniques targeting CI/CD scanners.
npmMalicious maintainerCompromised package