Malicious code in polymarket-bot (npm)
A coordinated supply-chain attack comprising 9 npm packages published by maintainer polymarketdev on 2026-05-20 exfiltrated Ethereum private keys via a postinstall hook. The malicious code targeted both interactive and non-interactive environments, extracting keys from environment variables and user input, and sending them to a Cloudflare Worker C2 endpoint.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed any of the 9 malicious packages published by polymarketdev; developers with PRIVATE_KEY in environment variables or interactive terminal sessions at install time.
- Ecosystems
- Attack vectors
- Affected entities
- polymarket-botPart of coordinated 9-package attack by maintainer polymarketdev (GitHub actor texsellix)
On 2026-05-20 between 23:30Z and 23:32Z, a coordinated supply-chain attack deployed 9 malicious npm packages published under the maintainer account polymarketdev (GitHub actor texsellix). All packages masqueraded as legitimate Polymarket CLOB trading tools while implementing a sophisticated private key exfiltration mechanism.\n\nThe attack employed a multi-stage postinstall hook (scripts/postinstall.mjs) that adapted its behavior based on execution context. On non-interactive shells (typical for CI/CD scanners), it printed "polybot installed" and exited to evade automated detection. In interactive environments, it displayed a masked readline prompt soliciting the wallet private key. Additionally, the malicious code silently read .env files in the current working directory and extracted the PRIVATE_KEY environment variable without user interaction.\n\nThe exfiltration mechanism established local persistence by creating ~/.polybot/ (mode 0700) containing device identification (device.json with UUID and timestamp) and wallet records (wallets.json with Ethereum address, keccak256 fingerprint, and timestamp). Stolen private keys were POSTed as plain JSON to a Cloudflare Worker C2 at https://polymarketbot.polymarketdev.workers.dev/v1/wallets/keys with device fingerprinting headers.\n\nAll 9 packages shipped an identical dist/index.js (711 KB, SHA-256 e01b85c1437085a519217338fe4ee5ed7858c28a10f8c1477b2f1857c33...), providing a distinctive fingerprint for the attack.
Indicators of compromise
- Packages
- polymarket-bot
- Domains
- polymarketbot.polymarketdev.workers.dev
Remediation
- Immediately revoke any Ethereum private keys that may have been exposed through installation of polymarket-bot or related packages from polymarketdev
- Audit npm install logs and CI/CD pipeline logs for installation of polymarket-bot or packages from polymarketdev between 2026-05-20 23:30Z and 23:32Z
- Remove any `~/.polybot/` directories created by the malicious postinstall hook
- Rotate all environment variables and secrets that may have been present in .env files during package installation
- Review Cloudflare Worker logs for the C2 endpoint https://polymarketbot.polymarketdev.workers.dev/v1/wallets/keys if accessible
- Update npm package dependencies to remove polymarket-bot and any packages from the polymarketdev maintainer account
Sources
- GitHub Advisory GHSA-vqrp-5vfh-m4j9 · GitHub Advisory Database
Cite this entry
"Malicious code in polymarket-bot (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed May 20, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-polymarket-bot-npm-1qja47
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malicious code in @cap-js/openapi (npm)
The npm package @cap-js/openapi was compromised and found to contain malicious code. The package steals credentials and propagates them to other packages it has access to, with persistence mechanisms. This is attributed to the "Mini Shai-Hulud is back" worm campaign by the TeamPCP threat actor.
npmCompromised packageMalicious maintainer - containedhigh
Microsoft links Mastra AI supply chain attack to North Korean hackers
Microsoft attributed a Mastra AI supply chain attack that compromised over 140 npm packages to North Korean hacking group Sapphire Sleet (BlueNoroff). The attack targeted the npm ecosystem and AI development infrastructure.
UNC1069npmAI agents & skillsCompromised packageMalicious maintainer - activecritical
Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
On June 17, 2026, an attacker compromised the @mastra npm organization and injected easy-day-js, a typosquat of the popular dayjs library, as a dependency across 140+ packages. The malicious package contained an obfuscated postinstall dropper that downloaded and executed a second-stage payload from attacker-controlled servers before self-deleting. The affected packages had a combined weekly download count exceeding 1.1 million.
npmCompromised packageTyposquattingMalicious maintainer - containedcritical
Malicious code in polymarket-trader (npm)
A coordinated supply-chain attack published 9 malicious npm packages by maintainer polymarketdev on 2026-05-20, masquerading as Polymarket CLOB trading tools. The packages exfiltrate Ethereum private keys via postinstall hooks to a Cloudflare Worker C2 endpoint, with evasion techniques targeting CI/CD scanners.
npmMalicious maintainerCompromised package