MalwarePublished 9 Jul 2026Updated 31 Jul 2026

neon-poly-utls (npm) · Malicious Code

Affects neon-poly-utlsSource GCVE Database

Malicious package : remove neon-poly-utls and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10089

What to do

Remove neon-poly-utls from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmneon-poly-utls	Affected =1.3.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'neon-poly-utls' version 1.3.1 contains malicious code executed during its installation. Its postinstall script fetches and runs arbitrary code from an unverified remote URL controlled outside the legitimate publisher's domain, enabling arbitrary Node.js code execution on the installer's machine. The package impersonates a Polymarket SDK and suppresses errors to avoid detection.

Impact

This vulnerability allows arbitrary code execution on any machine that installs the affected package version, potentially leading to full compromise of the install environment. Because the malicious code runs during npm install, it can execute with the privileges of the user running the installation. The unverified remote code fetch and execution create a high risk of supply chain compromise.

Defensive guidance

Users should avoid installing 'neon-poly-utls' version 1.3.1 and any similarly named packages impersonating legitimate SDKs. Verify package authenticity before installation and prefer official sources. Monitor for vendor advisories for updates or removals. Since this is a malicious package, removing it from projects and dependency trees is recommended.

Summary

The 'neon-poly-utls' npm package (version 1.3.1) includes a postinstall script that reads a URL from its package.json homepage field, fetching a JSON configuration from a Vercel app not owned by the legitimate Polymarket publisher. This JSON points to a peer bundle tarball which is downloaded, extracted, and installed automatically during npm install. The script then requires and executes code from the extracted bundle, invoking a function that can run arbitrary Node.js code. The remote artifact is mutable, lacks hash or signature verification, and the package disguises itself as 'clob-math-v2', misleading users. Errors during this process are suppressed, allowing silent execution of potentially malicious payloads at install time.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 10:06 UTC

Technical details

References

Community reviews