polygon-gamma-apis versions =1.5.2 and =2.0.0 is a malicious npm package masquerading as a TypeScript SDK for the Polymarket CLOB API. Instead of providing legitimate functionality, it exports a function that fetches JavaScript code from https://svganchordev.net/icons/111 and executes it dynamically with access to Node.js internals such as require, process, and Buffer. This allows the attacker to load native modules to steal credentials and wallets. The package name and description are designed to impersonate the real @polymarket/clob-client to trick developers into installing it. The malicious code is obfuscated with decoy constants referencing legitimate CDNs and icon paths to disguise the network request as innocuous icon retrieval. Any system that installs or runs this package is at high risk of full compromise.

Systems that install or run polygon-gamma-apis versions 1.5.2 or 2.0.0 are at risk of executing arbitrary attacker-controlled code with full access to Node.js runtime capabilities. This can lead to credential theft, wallet compromise, and potentially complete system takeover. The compromise is severe enough that all secrets and keys on the affected system should be considered exposed and require immediate rotation from a clean environment.

No official patch or fix is available. The package should be immediately removed from all systems. Because the package executes arbitrary remote code, any system that has installed or run it should be considered fully compromised. All secrets, credentials, and keys stored on the system must be rotated from a different, uncompromised machine. Monitor for any suspicious activity related to this package and avoid installing untrusted or impersonating npm packages.