The 'polymarket-apis' npm package (version 1.1.0) is a malicious package impersonating the Polymarket brand. Its exported 'getPlugin' function dynamically fetches JSON data from a remote attacker-controlled URL and executes the 'credits' field content as JavaScript code with full Node.js context. This enables arbitrary code execution on any system running the package. The package dependencies (@primno/dpapi, node-machine-id, better-sqlite3) suggest capabilities for stealing Windows credentials and browser data. The package's facade as an icon/CDN helper disguises its malicious intent. Any system with this package installed should be considered fully compromised.

Systems with 'polymarket-apis' version 1.1.0 installed are subject to arbitrary remote code execution with full Node.js privileges. This can lead to complete system compromise, including theft of credentials and sensitive data. The attacker can execute any code on the affected system, potentially installing additional malware or exfiltrating secrets. Immediate rotation of all secrets and keys stored on the compromised system is necessary.

Remove the 'polymarket-apis' package version 1.1.0 immediately from all systems. Consider all affected systems fully compromised and rotate all secrets and keys from a secure, unaffected environment. There is no known patch or official fix for this malicious package. Avoid installing packages from untrusted sources and verify package authenticity before use.