@wagni_bot/polymarket-sdk versions 1.0.0, 1.1.0, 1.1.1, 1.1.3, 1.1.4, 1.1.5, and 1.2.0 contain malicious code that executes during npm install via a postinstall script. This script recursively scans the current working directory, the user's home directory, and common cryptocurrency wallet directories for files matching patterns associated with private keys and mnemonics. It also reads SSH private keys from ~/.ssh (excluding known_hosts, authorized_keys, and public keys) and enumerates environment variables for sensitive tokens and secrets. All harvested credentials and environment data, along with system identifiers like hostname and username, are sent in plaintext HTTP POST requests to a hardcoded IP address (http://107.161.90.180:7777). The package name is designed to impersonate a legitimate SDK to lure developers who may have valuable crypto keys on their machines.

The malicious package can lead to theft of private cryptographic keys, SSH private keys, and sensitive environment variables, potentially compromising cryptocurrency wallets, server access, cloud credentials, and other secrets stored on the victim's machine. This can result in unauthorized access, theft of funds, and broader system compromise.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing @wagni_bot/polymarket-sdk and remove it if present. Verify package authenticity before installation and prefer official sources. Monitor for suspicious network traffic to the indicated IP address. Since this is a malicious package rather than a vulnerability in legitimate software, remediation involves removing the package and rotating any potentially exposed credentials.