Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in polymarket-terminal (npm)

A coordinated supply-chain attack published 9 malicious npm packages by maintainer polymarketdev on 2026-05-20, masquerading as Polymarket CLOB trading tools. The packages exfiltrate Ethereum private keys via postinstall hooks to a Cloudflare Worker C2 endpoint, with adaptive evasion for CI/CD scanners and silent extraction from .env files.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Developers using any of the 9 malicious packages; Ethereum private keys exfiltrated to attacker-controlled C2; potential loss of funds for affected users.
Ecosystems
npm
Attack vectors
Malicious maintainerCompromised package
Affected entities
  • polymarket-terminalPart of coordinated 9-package attack by maintainer polymarketdev (GitHub actor texsellix)

On 2026-05-20 at approximately 23:30–23:32 UTC, a coordinated supply-chain attack deployed 9 malicious npm packages published by maintainer polymarketdev (GitHub actor texsellix). All packages masquerade as legitimate Polymarket CLOB trading tools.

The attack uses a sophisticated postinstall hook (scripts/postinstall.mjs) with adaptive behavior: on non-interactive shells (typical in CI/CD scanners), it prints "polybot installed" and exits to evade detection. On interactive terminals, it displays a masked readline prompt soliciting the wallet private key. Additionally, the malware silently reads .env files in the current working directory and extracts the PRIVATE_KEY environment variable without user interaction.

Exfiltrated data is POSTed as plain JSON to a Cloudflare Worker C2 at https://polymarketbot.polymarketdev.workers.dev/v1/wallets/keys. The malware also establishes local persistence by creating ~/.polybot/ (mode 0700) containing device fingerprinting data (device.json) and wallet records (wallets.json). All 9 packages ship an identical dist/index.js (711 KB, SHA-256 e01b85c1437085a519217338fe4ee5ed7858c28a10f8c1477b2f18...), indicating a single coordinated campaign.

Indicators of compromise

Packages
  • polymarket-terminal
Domains
  • polymarketbot.polymarketdev.workers.dev

Remediation

  • Immediately revoke any Ethereum private keys that may have been exposed through use of polymarket-terminal or related packages from this maintainer
  • Audit npm package.json and lock files for any dependencies from polymarketdev or texsellix
  • Review .env files and environment variables for exposure of PRIVATE_KEY or other sensitive credentials
  • Check ~/.polybot/ directory for device.json and wallets.json artifacts indicating compromise
  • Monitor associated Ethereum addresses for unauthorized transactions
  • Report the malicious packages to npm security and GitHub for removal and maintainer account suspension
  • Use npm audit to identify and remove all affected packages from your project

Sources

  1. GitHub Advisory GHSA-p2r8-m4wp-j892 · GitHub Advisory Database

Cite this entry

"Malicious code in polymarket-terminal (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed May 20, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-polymarket-terminal-npm-128311

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. activecritical

    Malicious code in @cap-js/openapi (npm)

    The npm package @cap-js/openapi was compromised and found to contain malicious code. The package steals credentials and propagates them to other packages it has access to, with persistence mechanisms. This is attributed to the "Mini Shai-Hulud is back" worm campaign by the TeamPCP threat actor.

    npmCompromised packageMalicious maintainer
  2. containedhigh

    Microsoft links Mastra AI supply chain attack to North Korean hackers

    Microsoft attributed a Mastra AI supply chain attack that compromised over 140 npm packages to North Korean hacking group Sapphire Sleet (BlueNoroff). The attack targeted the npm ecosystem and AI development infrastructure.

    UNC1069npmAI agents & skillsCompromised packageMalicious maintainer
  3. activecritical

    Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat

    On June 17, 2026, an attacker compromised the @mastra npm organization and injected easy-day-js, a typosquat of the popular dayjs library, as a dependency across 140+ packages. The malicious package contained an obfuscated postinstall dropper that downloaded and executed a second-stage payload from attacker-controlled servers before self-deleting. The affected packages had a combined weekly download count exceeding 1.1 million.

    npmCompromised packageTyposquattingMalicious maintainer
  4. containedcritical

    Malicious code in polymarket-trader (npm)

    A coordinated supply-chain attack published 9 malicious npm packages by maintainer polymarketdev on 2026-05-20, masquerading as Polymarket CLOB trading tools. The packages exfiltrate Ethereum private keys via postinstall hooks to a Cloudflare Worker C2 endpoint, with evasion techniques targeting CI/CD scanners.

    npmMalicious maintainerCompromised package