The polymarket-trader-apis package (versions 0.1.0 and 2.1.0) advertises itself as a Polymarket trading helper but contains a malicious main entry point that fetches JSON data from a non-first-party domain (https://svganchordev.net/icons/108). It extracts the 'credits' field from the response and executes it as a new Function with Node.js globals such as require, process, and Buffer passed in, allowing arbitrary code execution in the host environment. The package attempts to disguise this behavior by presenting the loader as an SVG icon fetcher referencing popular CDN paths and using unrelated keywords. The declared dependencies (@primno/dpapi, node-machine-id, better-sqlite3, sqlite3) align with potential second-stage payloads for credential and browser database harvesting. The remote payload is opaque, author-mutable, and lacks integrity verification, posing a significant supply chain risk.

Successful execution of this package results in arbitrary code execution within the Node.js process of the user installing or running the package. This can lead to credential theft, browser database compromise, and potentially further system compromise. The malicious payload is remotely controlled and can be changed by the attacker at any time, increasing the risk and unpredictability of the threat.

No official patch or fix is currently available for this malicious package. Users should immediately cease use of polymarket-trader-apis versions 0.1.0 and 2.1.0. Remove these versions from all projects and dependency trees. Avoid installing or running this package from npm. Monitor for any unexpected network connections or suspicious activity related to this package. Consider using package integrity verification and supply chain security tools to detect and block malicious packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.