The polymarket-gamma-apis package distributed via npm is identified as containing malicious code that results in a full system compromise upon installation or execution. The compromise is severe enough that all secrets and keys stored on the affected machine should be considered exposed and must be rotated immediately from a separate, uncompromised system. Simply uninstalling the package is insufficient to ensure system integrity, as the attacker may have installed additional persistent malicious components. There is no CVSS score available for this threat, and no known exploits in the wild have been reported. The threat is confirmed by the GHSA advisory GHSA-59wg-mh66-248p and cataloged under MAL-2026-10149 in the GCVE database.

Full compromise of any computer with the polymarket-gamma-apis package installed or running. Potential exposure and theft of all stored secrets and keys on the system. Persistence of malicious software beyond removal of the package is possible, leading to ongoing unauthorized access and control.

Remove the polymarket-gamma-apis package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines using a different, trusted computer. Conduct a thorough investigation and remediation of the affected systems to detect and remove any additional malicious software or backdoors. Because the attacker may have persistent access, consider rebuilding the system from a known good state. No official patch or fix is available; remediation relies on removal and secret rotation.