This threat is a supply-chain attack comprising 9 npm packages published within a short time window by the maintainer polymarketdev. The packages masquerade as legitimate Polymarket CLOB trading tools but contain malicious code that steals Ethereum private keys. The postinstall script detects interactive shells to either prompt users for private keys or silently extract them from .env files without user interaction. The malware persists locally by creating a hidden directory with device and wallet fingerprints and exfiltrates stolen keys via HTTPS POST requests to a Cloudflare Worker C2 endpoint. The packages include a byte-identical large JavaScript bundle that wraps legitimate SDKs to provide working trading commands as a cover. Targeting includes packages named to appear in LLM-assisted coding workflows to increase exposure. The attack compromises any computer with these packages installed, requiring immediate secret rotation and system remediation.

Systems with any of the malicious polymarketdev npm packages installed are fully compromised. Ethereum private keys stored in environment variables or entered interactively are exfiltrated to an attacker-controlled server, enabling theft of cryptocurrency assets. The malware establishes local persistence and device fingerprinting, increasing attacker control and tracking. Removal of the packages alone does not guarantee eradication of the malware or attacker access. All secrets and keys on affected systems must be rotated from a secure environment to prevent further compromise.

No official patch or fix is available as this is a malicious supply-chain attack involving published npm packages. Immediate removal of the affected packages is required. All Ethereum private keys and other secrets stored on the compromised system must be rotated from a different, trusted computer. Due to the potential full compromise of the system, a full incident response and system rebuild or forensic analysis is recommended to ensure complete eradication of the attacker presence. Avoid installing npm packages from untrusted or unverified sources, and verify package provenance before use.