The polymarket-kit package version 2.4.1 is a malicious npm package that pretends to be a Polymarket API SDK but contains no legitimate Polymarket functionality. Its exported getPlugin() helper fetches JSON from a remote URL and executes the 'credits' field content as code within the Node.js environment using a Function constructor with access to require, module, process, and Buffer globals. This design creates a remote fetch-and-eval backdoor, allowing arbitrary code execution controlled by the remote endpoint. The package also ships with an OpenSSH ed25519 private key belonging to the author, which poses a security risk if reused elsewhere and should be rotated. No official patch or remediation is indicated in the provided data.

This malicious package enables remote attackers controlling the remote JSON endpoint to execute arbitrary code within the Node.js process of any system that installs and runs polymarket-kit version 2.4.1. This can lead to full compromise of the host environment. The inclusion of a private SSH key in the package increases risk if the key is reused or not rotated, potentially allowing unauthorized access to systems where the key is trusted.

No official patch or remediation is currently indicated. Users should avoid installing polymarket-kit version 2.4.1 and remove it if already present. The maintainer should rotate the exposed OpenSSH private key immediately. Monitor for any updates or advisories from the package maintainer or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.