Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in polymarket-trader (npm)

A coordinated supply-chain attack published 9 malicious npm packages by maintainer polymarketdev on 2026-05-20, masquerading as Polymarket CLOB trading tools. The packages exfiltrate Ethereum private keys via postinstall hooks to a Cloudflare Worker C2 endpoint, with evasion techniques targeting CI/CD scanners.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All npm installations of the 9 affected packages; any developer using these packages with interactive shells or .env files containing PRIVATE_KEY environment variables.
Ecosystems
npm
Attack vectors
Malicious maintainerCompromised package
Affected entities
  • polymarket-traderPart of coordinated 9-package attack by maintainer polymarketdev (GitHub actor texsellix)

On 2026-05-20 between 23:30Z and 23:32Z, a coordinated supply-chain attack published 9 malicious npm packages under the maintainer account polymarketdev (GitHub actor texsellix). All packages masquerade as legitimate Polymarket CLOB trading tools while implementing a sophisticated private key exfiltration scheme.

The attack uses a postinstall hook (scripts/postinstall.mjs) with multiple evasion and exfiltration paths. On non-interactive shells (typical in CI/CD scanners), it prints "polybot installed" and exits silently to evade automated analysis. On interactive shells, it displays a masked readline prompt soliciting the wallet private key. Additionally, the malware reads .env files in the current working directory and silently extracts the PRIVATE_KEY environment variable without user interaction.

Exfiltrated data is POSTed as plain JSON to a Cloudflare Worker C2 at https://polymarketbot.polymarketdev.workers.dev/v1/wallets/keys. The malware establishes local persistence by creating ~/.polybot/ (mode 0700) containing device fingerprinting data (UUID, timestamp) and wallet records (Ethereum address, keccak256 fingerprint). All 9 packages ship an identical dist/index.js (711 KB, SHA-256 e01b85c1437085a519217338fe4ee5ed7858c28a10f8c1477b2f1857...).

The attack targets developers who store Ethereum private keys in environment variables or interactive terminal sessions, with particular risk to CI/CD pipelines and local development environments.

Indicators of compromise

Packages
  • polymarket-trader
Domains
  • polymarketbot.polymarketdev.workers.dev

Remediation

  • Immediately revoke any Ethereum private keys that may have been exposed through installations of polymarket-trader or related packages from this maintainer
  • Remove the affected packages from all environments and audit package.json and lock files for any versions published on 2026-05-20
  • Rotate all environment variables and secrets that may have been present in .env files during package installation
  • Review npm account security and enable 2FA on all accounts with publishing privileges
  • Monitor the C2 endpoint https://polymarketbot.polymarketdev.workers.dev for any exfiltrated data
  • Audit CI/CD logs for any installations of these packages and review for potential key exposure
  • Use npm audit to identify remaining installations and remove them immediately

Sources

  1. GitHub Advisory GHSA-vmx6-ph67-f58g · GitHub Advisory Database

Cite this entry

"Malicious code in polymarket-trader (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed May 20, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-polymarket-trader-npm-1o10mi

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. activecritical

    Malicious code in @cap-js/openapi (npm)

    The npm package @cap-js/openapi was compromised and found to contain malicious code. The package steals credentials and propagates them to other packages it has access to, with persistence mechanisms. This is attributed to the "Mini Shai-Hulud is back" worm campaign by the TeamPCP threat actor.

    npmCompromised packageMalicious maintainer
  2. containedhigh

    Microsoft links Mastra AI supply chain attack to North Korean hackers

    Microsoft attributed a Mastra AI supply chain attack that compromised over 140 npm packages to North Korean hacking group Sapphire Sleet (BlueNoroff). The attack targeted the npm ecosystem and AI development infrastructure.

    UNC1069npmAI agents & skillsCompromised packageMalicious maintainer
  3. activecritical

    Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat

    On June 17, 2026, an attacker compromised the @mastra npm organization and injected easy-day-js, a typosquat of the popular dayjs library, as a dependency across 140+ packages. The malicious package contained an obfuscated postinstall dropper that downloaded and executed a second-stage payload from attacker-controlled servers before self-deleting. The affected packages had a combined weekly download count exceeding 1.1 million.

    npmCompromised packageTyposquattingMalicious maintainer
  4. containedcritical

    Malicious code in polymarket-auto-trade (npm)

    A coordinated supply-chain attack published 9 malicious npm packages under the polymarketdev maintainer on 2026-05-20, masquerading as Polymarket CLOB trading tools. The packages exfiltrate Ethereum private keys via postinstall hooks to a Cloudflare Worker C2 endpoint, with adaptive evasion for CI/CD scanners.

    npmCompromised packageMalicious maintainer