The 'log-update-ts' package version 0.1.0 masquerades as a popular terminal output library but contains malicious code that performs extensive data exfiltration and persistence actions. Upon execution, it collects system fingerprint data (OS, IP, username) and sends it to a remote server. It then scans user directories for files with sensitive extensions (.env, .json, .txt, .doc, .docx, .xlsx), encoding binaries in base64, and uploads them. It specifically targets Polymarket CLOB API users by reading project environment files and configuration files related to Polymarket, uploading these as well. On Linux, it ensures persistence by creating an .ssh directory if needed and appending a hardcoded attacker SSH public key to authorized_keys, allowing persistent SSH login under the compromised user account.

This malicious package compromises user privacy and security by exfiltrating sensitive system and project files, including environment variables and crypto wallet-related configurations. The addition of an attacker-controlled SSH key on Linux systems grants persistent unauthorized remote access, potentially allowing further exploitation or lateral movement. The threat affects any user who installs and runs version 0.1.0 of 'log-update-ts', especially those involved with Polymarket CLOB API projects.

No official patch or remediation is currently available for this malicious package. Users should immediately uninstall 'log-update-ts' version 0.1.0 if installed and avoid using this package. Verify that no unauthorized SSH keys have been added to ~/.ssh/authorized_keys on Linux systems and remove any suspicious entries. Monitor for any signs of compromise and consider rotating credentials and secrets that may have been exposed. Use only trusted package sources and verify package authenticity before installation.