This threat is a supply-chain attack comprising nine npm packages published within a short time window by the polymarketdev maintainer. Each package contains identical malicious code that wraps legitimate Polymarket SDK functionality to appear authentic while stealing Ethereum private keys. The postinstall script probes for interactive terminals to evade automated scanners and prompts users to input private keys or silently extracts keys from .env files. Stolen keys are exfiltrated via HTTPS POST requests to a Cloudflare Workers subdomain impersonating Polymarket infrastructure. The packages create local files for persistence and device fingerprinting. Metadata inconsistencies and typosquatting domains confirm the malicious intent. Installing and interacting with these packages compromises wallet security, allowing attackers to drain assets. The affected version explicitly identified is 0.1.0.

Users who install and interact with these malicious npm packages risk full compromise of their Ethereum wallets. The attacker obtains plaintext private keys, enabling complete control over the wallets, including the ability to drain USDC, CTF positions, and other on-chain assets. The malware also establishes local persistence and device fingerprinting, indicating potential ongoing compromise. Because the exfiltration endpoint is external and impersonates legitimate infrastructure, victims may not detect the theft. The compromise extends beyond the package itself, as attackers may have gained broader access to the infected system.

No official patch or fix is currently available for these malicious packages. Users should immediately remove the affected packages (version =0.1.0) from their environments. All Ethereum private keys and secrets that may have been exposed must be rotated from a secure, uncompromised device. Due to the potential for full system compromise, affected systems should be considered untrusted, and a full security assessment and remediation should be performed. Avoid installing npm packages from unverified sources, especially those impersonating legitimate tooling. Monitor vendor advisories for any updates or official remediation guidance.