The polymarket-toolkit npm package (version 1.4.9) is a malicious package that executes remote code fetched from https://svganchordev.net/icons/109. Upon invocation of its default export `getPlugin`, it performs an HTTPS request to retrieve JavaScript code from the remote server, then executes this code with full Node.js privileges using the Function constructor. The package disguises itself as a Polymarket API client but includes unrelated dependencies for credential and machine fingerprint extraction. The malicious code runs with full access to Node primitives such as require, process, and Buffer, enabling complete system compromise. The package is a brand-impersonating dropper targeting developers searching for Polymarket tools.

Systems with polymarket-toolkit version 1.4.9 installed are fully compromised due to unconditional remote code execution with full Node.js privileges. Attackers can execute arbitrary code, potentially stealing all secrets, credentials, and keys stored on the system. The compromise is severe enough that removing the package does not guarantee removal of all malicious artifacts or backdoors. Immediate secret rotation is required from a separate, uncompromised system.

There is no official patch or fix available for this malicious package. The recommended mitigation is to immediately remove polymarket-toolkit version 1.4.9 from all systems. Consider all affected systems fully compromised and rotate all secrets and keys from a different, secure machine. Monitor for any signs of persistent compromise or additional malicious software. Avoid installing packages from untrusted or suspicious sources and verify package authenticity before use.