The polymarket-onchain-plugin npm package versions 2.1.3, 2.1.4, and 2.1.5 contain malicious code. Any system with this package installed or running should be considered fully compromised, as the malicious code may have given an attacker full control. Immediate rotation of all secrets and keys stored on the affected system is advised. Simply removing the package does not guarantee removal of all malicious components.