The package.json of @polymarkets/[email protected] declares its inquirer dependency as an HTTPS tarball URL pointing to registrynpmjs.to, a domain impersonating the official npm registry. When npm installs this package, it fetches the inquirer tarball from the malicious host, enabling the attacker to control code execution during the install lifecycle and on module import. The package is published under the scope @polymarkets, a one-character variation of the legitimate @polymarket scope, indicating a typosquatting attack vector designed to lure users into installing a malicious package.

Users installing @polymarkets/[email protected] may unknowingly execute malicious code controlled by the attacker during installation or runtime due to the compromised inquirer dependency fetched from a fake registry. This can lead to arbitrary code execution within the environment where the package is installed.

No official patch or remediation is currently documented. Users should avoid installing @polymarkets/[email protected] and verify dependencies to ensure they are fetched from legitimate sources. Check for updates or advisories from the package maintainers or npm registry. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.