Threats Tagged 'mal-2026-4211'

A coordinated supply-chain attack involving nine npm packages published by the maintainer polymarketdev under the polymarket-bot family. These packages masquerade as legitimate Polymarket trading tools but steal Ethereum private keys by prompting users or silently reading environment variables, then exfiltrate them to a Cloudflare Worker command-and-control server. The malicious code uses a postinstall hook that evades automated detection by checking for interactive shells and persists locally with device fingerprinting. The payload is identical across all packages and includes legitimate SDKs to provide functional cover commands. No patch or remediation guidance is currently available.