The polygon-gamma-apis npm package version 1.5.2 and 2.0.0 is a malicious package impersonating a legitimate Polymarket SDK. It executes attacker-controlled JavaScript fetched from a remote URL, enabling arbitrary code execution within the consumer's Node.js process. This can lead to credential and wallet theft by loading native modules. Any system with this package installed should be considered fully compromised.