The threat involves a malicious npm package, sleek-pretty@1.0.0, which targets developers running trading bots on Polymarket by executing a multi-stage attack upon import. The attack includes system fingerprinting, installing an SSH backdoor on Linux systems for persistent access, exfiltrating filesystem data, and stealing API credentials and private keys related to Polymarket's CLOB API and Ethereum/Polygon wallets. The attacker writes an SSH public key to authorized_keys to maintain access and can use stolen private keys to drain USDC balances. The campaign is attributed to the DPRK's Lazarus Group based on matching TTPs and publisher email infrastructure. There is no indication of a patch or fix, and the service is not cloud-hosted, so remediation depends on user action.

The impact includes unauthorized persistent access to affected Linux hosts via an SSH backdoor, exfiltration of sensitive filesystem data, theft of Polymarket CLOB API credentials, and Ethereum/Polygon wallet private keys. This enables the attacker to directly drain USDC cryptocurrency balances from compromised wallets. The compromise affects developers using the malicious npm package, potentially leading to significant financial loss and system compromise.

No official patch or remediation guidance is currently available. Users should immediately audit their npm dependencies for the presence of the sleek-pretty@1.0.0 package and remove it if found. Review and revoke any compromised API credentials and wallet private keys. Inspect Linux hosts for unauthorized SSH keys in authorized_keys and remove any suspicious entries. Rotate all affected credentials and wallet keys. Monitor for unusual SSH access and consider rebuilding compromised systems. Patch status is not yet confirmed — check vendor advisories or npm security channels for updates.