MalwarePublished 9 Jul 2026Updated 1 Sep 2026

polymarket-apis (npm) · Malicious Code

Affects polymarket-apisSource GCVE Database

Malicious package : remove polymarket-apis and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 19:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10067

What to do

Remove polymarket-apis from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpolymarket-apis	Affected =1.1.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'polymarket-apis' version 1.1.0 impersonates the Polymarket brand but contains no legitimate API integration. It executes attacker-controlled code fetched from a remote URL using JavaScript's Function constructor, allowing arbitrary code execution with full Node.js privileges. The package's declared dependencies align with known credential and browser data stealing payloads. Installation of this package compromises the host system, potentially exposing all stored secrets and keys.

Impact

Systems with 'polymarket-apis' version 1.1.0 installed are subject to arbitrary remote code execution with full Node.js privileges. This can lead to complete system compromise, including theft of credentials and sensitive data. The attacker can execute any code on the affected system, potentially installing additional malware or exfiltrating secrets. Immediate rotation of all secrets and keys stored on the compromised system is necessary.

Defensive guidance

Remove the 'polymarket-apis' package version 1.1.0 immediately from all systems. Consider all affected systems fully compromised and rotate all secrets and keys from a secure, unaffected environment. There is no known patch or official fix for this malicious package. Avoid installing packages from untrusted sources and verify package authenticity before use.

Summary

The 'polymarket-apis' npm package (version 1.1.0) is a malicious package impersonating the Polymarket brand. Its exported 'getPlugin' function dynamically fetches JSON data from a remote attacker-controlled URL and executes the 'credits' field content as JavaScript code with full Node.js context. This enables arbitrary code execution on any system running the package. The package dependencies (@primno/dpapi, node-machine-id, better-sqlite3) suggest capabilities for stealing Windows credentials and browser data. The package's facade as an icon/CDN helper disguises its malicious intent. Any system with this package installed should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 19:17 UTC

Technical details

References

Community reviews