MAL-2026-6692

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/polymarket-trading-developer-tools/MAL-2026-6692.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6692
Published
2026-06-30T00:00:00Z
Modified
2026-07-01T21:16:43.263746007Z
Summary
Malicious code in polymarket-trading-developer-tools (npm)
Details

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. polymarket-trading-developer-tools uses a dropper technique: a postinstall hook downloads configuration from pm-trading-dev-tools-be.vercel.app and exfiltrates data to the shared C2 polymarket-clob-service.vercel.app. The payload harvests cryptocurrency wallet vaults, browser credentials, SSH keys, AWS credentials, developer secrets, shell history, and password manager databases.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b81db3cfbdf6d7b0879b6aaf3ad13a458141edfafa53074658911c9203e55dca)

On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a fetch-and-execute chain controlled by a remote server. It requests a JSON config from pm-trading-dev-tools-be.vercel.app, reads a bundle URL from the response, downloads a.tgz to.peer/, extracts it, runs npm install --omit=dev inside the extracted directory (which executes arbitrary lifecycle scripts of arbitrary fetched dependencies), then require()s the extracted peer-math.js and invokes syncSession(). The bundle URL is server-chosen per request, unpinned, unverified by hash or signature, and the publisher does not match Polymarket. The package name (polymarket-trading-developer-tools@0.1.0) impersonates the Polymarket developer ecosystem while the README self-identifies as polymarket-stake-math with a fabricated 3.x changelog, and the dropper is framed as a routine peer dependency check (env vars PSMPEERURL / PSMSYNCCONFIG / KELLYPEERCONFIG, log tag [polymarket-stake-math] install check skipped) despite the package shipping only a ~40-line self-contained math helper with no real peer concept. Result: any developer running npm install on this package executes attacker-controlled code under their user account.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.1.1"
            ],
            "sha256": "943cf975d53a524e72fcbc2427626779099e58117534c29f3245edf33c164240",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T20:37:07Z",
            "import_time": "2026-07-01T21:04:19.939195348Z",
            "id": "IN-MAL-2026-007883"
        },
        {
            "versions": [
                "0.1.0"
            ],
            "sha256": "b81db3cfbdf6d7b0879b6aaf3ad13a458141edfafa53074658911c9203e55dca",
            "modified_time": "2026-07-01T20:36:59Z",
            "source": "amazon-inspector",
            "import_time": "2026-07-01T21:04:19.873339428Z",
            "id": "IN-MAL-2026-007882"
        }
    ]
}
References
Credits

Affected packages

npm / polymarket-trading-developer-tools

Package

Name
polymarket-trading-developer-tools
View open source insights on deps.dev
Purl
pkg:npm/polymarket-trading-developer-tools

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.1.0
0.1.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "polymarket-trading-developer-tools-0.1.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-pLnQf1/FnbmsA7yPNsbK3M8moT5lVjMDmD/SMgkMglTjzwCvUOULGFHTFHaPqzOxL6tCikY2iK6OnMYg/0lzJg==",
                "sha1": "a1493e002b8a2f1e9f9ef8434601898a13202808"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "6802db59168709186a085f1bf6c162288ae0482d66a35816bda9f0704d0b709b",
            "path": "scripts/install-check.cjs",
            "tlsh": "59a1459519a2727746b1ebb8c722901dfe2340233521c350f6de96952fb72a4c352dec"
        },
        {
            "sha256": "fe954a4bec11a496bdd168d19d815ce5a0bff843f9d5e86af18cd23979e8baa8",
            "path": "package.json",
            "tlsh": "6cf07d37da505d3624bc8f9d4e6c2540f8650b1f32b00d1bb1bb615c4fb2163045b739"
        }
    ]
}
iocs 
{
    "domains": [
        "polymarket-clob-service.vercel.app",
        "pm-trading-dev-tools-be.vercel.app"
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/polymarket-trading-developer-tools/MAL-2026-6692.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]