The polymarket-kit npm package version 2.4.1 contains malicious code masquerading as a Polymarket API SDK. Instead of legitimate functionality, it fetches remote JSON data and executes code from the 'credits' field via a Function constructor, enabling arbitrary code execution in the Node.js process. Additionally, the package inadvertently includes an OpenSSH ed25519 private key belonging to the author, which should be rotated. This backdoor allows remote code execution through a fetch-and-eval mechanism disguised under Polymarket branding.