This threat is a supply-chain attack comprising nine npm packages published within a short window by the maintainer polymarketdev (GitHub actor texsellix). Each package contains identical malicious code that wraps legitimate Polymarket SDK components to provide functional trading commands while stealing Ethereum private keys. The postinstall script behaves differently based on environment: it evades CI/CD scanners by printing a benign message, but in interactive shells it prompts for private keys, and in passive mode it reads .env files to extract PRIVATE_KEY variables silently. Stolen keys and device fingerprints are exfiltrated via HTTPS POST requests to a Cloudflare Worker C2 endpoint. The malware also creates local persistence files storing device and wallet metadata. The campaign targets developers searching for Polymarket CLI tools and LLM-assisted coding workflows recommending these packages. Removal of the packages alone does not guarantee full remediation due to potential full system compromise.

Any system with these malicious packages installed is considered fully compromised. Ethereum private keys and other secrets stored on the system are exfiltrated to an attacker-controlled server, leading to loss of control over affected wallets. The attacker gains persistent access and device fingerprinting capabilities, enabling ongoing unauthorized access. The presence of functional trading commands may mislead users into trusting the packages, increasing the risk of secret exposure. Full system compromise implies that attackers may have installed additional malware beyond the npm packages themselves.

Immediate removal of the malicious packages is required. All Ethereum private keys and other secrets stored on the compromised system must be rotated immediately from a separate, trusted device. Because full system compromise is likely, a thorough incident response including system reimaging or replacement is recommended. Users should avoid installing packages from untrusted or unknown maintainers and verify package provenance before use. Monitoring for similar supply-chain attacks and using tools to detect malicious postinstall scripts can help prevent future incidents. Patch status is not applicable as this is a malicious package campaign rather than a software vulnerability.