This threat involves nine npm packages published within a short time window by the maintainer polymarketdev (GitHub actor texsellix). Each package contains identical malicious code in dist/index.js that wraps legitimate Polymarket SDK functionality to avoid suspicion. The postinstall script detects interactive terminals to prompt users for Ethereum private keys or silently extracts PRIVATE_KEY environment variables from .env files. It stores device and wallet metadata locally and exfiltrates stolen keys as JSON over HTTPS to a Cloudflare Worker C2 endpoint. The packages are named to appear in AI-assisted developer workflows, increasing the likelihood of installation without provenance checks. Removal of the packages does not guarantee full remediation due to potential system compromise.

Any system with these packages installed or running is considered fully compromised. Ethereum private keys and other secrets stored on the system are stolen and sent to an attacker-controlled server, enabling unauthorized access to blockchain assets. The malware achieves persistence and fingerprints infected devices, increasing attacker control. The attack undermines trust in the npm ecosystem and developer supply chains, especially those using AI-assisted coding tools.

Immediate removal of the malicious packages is required. All Ethereum private keys and related secrets stored on the compromised system must be rotated from a separate, trusted device. Due to potential full system compromise, consider rebuilding or thoroughly cleaning the affected environment. Exercise caution when installing packages recommended by AI-assisted coding tools and verify package provenance before use. Monitor official advisories for updates or additional remediation guidance. Patch status is not yet confirmed — check vendor or repository advisories for current remediation guidance.