This threat is a supply-chain attack where nine npm packages published by the maintainer polymarketdev (GitHub actor texsellix) masquerade as Polymarket CLOB trading tools. The packages contain a malicious postinstall script that detects interactive terminals to prompt users for Ethereum private keys or silently reads PRIVATE_KEY environment variables from .env files. The stolen keys are exfiltrated via HTTPS POST requests to a Cloudflare Worker endpoint controlled by the attacker. The packages create local persistence files for device fingerprinting and track exfiltration timestamps. The malicious payload is identical across all packages except for the package name. The attack targets developers using Polymarket-related packages, including polymarket-trade version 0.1.0, aiming to steal private keys controlling real USDC and Polymarket positions.

Compromise of Ethereum private keys allows attackers to fully control victims' Polygon wallets, enabling theft of USDC and manipulation of Polymarket positions. Any system installing these packages is considered fully compromised, with all secrets and keys at risk. The attacker gains persistent device fingerprinting and can track stolen keys over time. The malicious packages deceive users by providing legitimate trading functionality as cover, increasing the likelihood of key theft.

No official patch or fix is currently available. Users should immediately remove these malicious packages and consider all secrets and keys stored on affected systems compromised. Rotate all Ethereum private keys from a secure, uncompromised environment. Avoid installing packages from untrusted or unknown maintainers, especially those related to Polymarket trading. Monitor for suspicious postinstall scripts in npm packages and verify package provenance before installation.