{"id":"MAL-2026-14050","summary":"Malicious code in @polymarkets/clob-client-v2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7e06fdabf4b8b56bb40b4656a1a254801f37bef08278111f59814e375be3e7dc)\npackage.json for @polymarkets/clob-client-v2 declares its inquirer dependency as an HTTPS tarball URL on registrynpmjs.to, a lookalike of the real npm registry (registry.npmjs.org): \"inquirer\": \"https://registrynpmjs.to/inquirer-14.0.2.tgz\". On npm install, npm fetches and installs whatever tarball that host serves as inquirer into node_modules, so the operator of registrynpmjs.to controls the code that runs via inquirer's install lifecycle and on first require. The package is also published under the scope @polymarkets, a one-character variation of the legitimate Polymarket scope @polymarket, consistent with a typosquat lure whose delivery vector is the redirected dependency.\n","modified":"2026-08-14T20:31:47.560590592Z","published":"2026-08-14T20:07:11Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-14T20:07:11Z","sha256":"7e06fdabf4b8b56bb40b4656a1a254801f37bef08278111f59814e375be3e7dc","source":"amazon-inspector","versions":["1.0.6"],"id":"IN-MAL-2026-017928","import_time":"2026-08-14T20:14:23.595629659Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@polymarkets/clob-client-v2/v/1.0.6"}],"affected":[{"package":{"name":"@polymarkets/clob-client-v2","ecosystem":"npm","purl":"pkg:npm/%40polymarkets/clob-client-v2"},"versions":["1.0.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@polymarkets/clob-client-v2/MAL-2026-14050.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"clob-client-v2-1.0.6.tgz","hashes":{"sha1":"b18950226b10cb609c0fbdf72a574ba1cbb5e645","sha512_sri":"sha512-5xvVWKCE7TzFPLq2ZvMo6F2K2FLZSKPjAwdRkliXBdmaeCqe+82jn0ZXrNyrr6tKHdq96x1gWaqrBHDwOd+bbQ=="}}],"evidence_files":[{"tlsh":"b241ab54cc65ceb305c426e9dc7a8a4aa13144074c50fd0973ce462d4f8c26f25feaae","path":"package.json","sha256":"1dfe0c6ca840a057a4cd92b07fad8d18e346fbe4766734eb89e47154b9625852"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}