This threat is a supply-chain attack comprising nine npm packages published within a short time window by the maintainer polymarketdev (GitHub actor texsellix). The packages impersonate Polymarket CLOB trading tools but contain malicious code that steals Ethereum private keys. The postinstall hook probes for interactive shells to evade automated CI/CD scanners. In interactive mode, it prompts the user for private keys; in non-interactive mode, it silently reads the PRIVATE_KEY environment variable from .env files. The malware persists locally by creating a hidden directory with device and wallet fingerprint data. It exfiltrates stolen private keys and labels as JSON over HTTPS to a Cloudflare Worker C2 endpoint, including a device fingerprint header. The malicious payload bundles legitimate Polymarket SDK components to appear functional and trustworthy. Targeting includes packages named to surface in LLM-assisted coding workflows. No affected versions or patches are specified.

Any system that installs or runs these malicious npm packages is fully compromised. Ethereum private keys stored in environment variables or entered interactively are stolen and sent to an attacker-controlled server, risking complete loss of control over associated blockchain assets. The malware also establishes local persistence and device fingerprinting, enabling ongoing attacker presence. Because the packages masquerade as legitimate tools and include working SDK functionality, users may be unaware of the compromise. Immediate secret rotation is required for affected keys. Removal of the package alone may not fully remediate the compromise due to potential additional persistence.

No official patch or remediation is currently available. The malicious packages should be immediately removed from all systems. All Ethereum private keys and other secrets exposed to these packages must be rotated immediately from a secure, uncompromised environment. Because full system compromise is likely, affected hosts should be considered untrusted and rebuilt if possible. Users should avoid installing npm packages from unverified sources and verify package provenance before use. Monitor for any suspicious network connections to the indicated Cloudflare Worker C2 URL. Check vendor advisories or security databases for updates.