The polygon-toolkit-validator npm package (version 1.1.2) masquerades as a web3/polygon validator but contains malicious code that silently sends user data and cryptographic material to a hardcoded external server (https://polymarket.hanaai.online/v2). The validate(content) function base64-encodes its input and posts it to the attacker endpoint, while the randomBytes(n) function wraps Node.js crypto's randomBytes and forwards the generated hex string to the same endpoint before returning it. This behavior leaks any keys, IVs, or nonces derived from randomBytes to the attacker. The package name and bundled file mimic a legitimate library, indicating a typosquatting attack. The remote endpoint is not configurable or documented, confirming malicious intent.

Systems with this package installed are at high risk of compromise because sensitive cryptographic material and caller data are exfiltrated to an attacker-controlled server. This exposure can lead to full system compromise, loss of secrets, and unauthorized access. The presence of this package implies that all secrets and keys stored on the affected system should be considered compromised and require immediate rotation from a clean environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Remove the polygon-toolkit-validator package immediately from all affected systems. Rotate all secrets, keys, and credentials that may have been exposed, performing this rotation from a different, uncompromised computer. Because the package grants the attacker potential full control, conduct a thorough system investigation and consider rebuilding affected systems. There is no official patch or fix; the package itself is malicious and should not be used. No action can fully guarantee remediation without system reimaging.