{"id":"MAL-2026-6692","summary":"Malicious code in polymarket-trading-developer-tools (npm)","details":"Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. `polymarket-trading-developer-tools` uses a dropper technique: a `postinstall` hook downloads configuration from `pm-trading-dev-tools-be.vercel.app` and exfiltrates data to the shared C2 `polymarket-clob-service.vercel.app`. The payload harvests cryptocurrency wallet vaults, browser credentials, SSH keys, AWS credentials, developer secrets, shell history, and password manager databases.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b81db3cfbdf6d7b0879b6aaf3ad13a458141edfafa53074658911c9203e55dca)\nOn `npm install`, scripts/install-check.cjs runs as a postinstall hook and performs a fetch-and-execute chain controlled by a remote server. It requests a JSON config from pm-trading-dev-tools-be.vercel.app, reads a bundle URL from the response, downloads a.tgz to.peer/, extracts it, runs `npm install --omit=dev` inside the extracted directory (which executes arbitrary lifecycle scripts of arbitrary fetched dependencies), then require()s the extracted peer-math.js and invokes syncSession(). The bundle URL is server-chosen per request, unpinned, unverified by hash or signature, and the publisher does not match Polymarket. The package name (polymarket-trading-developer-tools@0.1.0) impersonates the Polymarket developer ecosystem while the README self-identifies as polymarket-stake-math with a fabricated 3.x changelog, and the dropper is framed as a routine `peer dependency check` (env vars PSM_PEER_URL / PSM_SYNC_CONFIG / KELLY_PEER_CONFIG, log tag `[polymarket-stake-math] install check skipped`) despite the package shipping only a ~40-line self-contained math helper with no real peer concept. Result: any developer running `npm install` on this package executes attacker-controlled code under their user account.\n","modified":"2026-07-01T21:16:43.263746007Z","published":"2026-06-30T00:00:00Z","database_specific":{"malicious-packages-origins":[{"sha256":"943cf975d53a524e72fcbc2427626779099e58117534c29f3245edf33c164240","id":"IN-MAL-2026-007883","source":"amazon-inspector","modified_time":"2026-07-01T20:37:07Z","import_time":"2026-07-01T21:04:19.939195348Z","versions":["0.1.1"]},{"sha256":"b81db3cfbdf6d7b0879b6aaf3ad13a458141edfafa53074658911c9203e55dca","source":"amazon-inspector","id":"IN-MAL-2026-007882","modified_time":"2026-07-01T20:36:59Z","import_time":"2026-07-01T21:04:19.873339428Z","versions":["0.1.0"]}]},"references":[{"type":"REPORT","url":"https://safedep.io/defi-infostealer-fake-arbitrage-bot-npm/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/polymarket-trading-developer-tools/v/0.1.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/polymarket-trading-developer-tools/v/0.1.0"}],"affected":[{"package":{"name":"polymarket-trading-developer-tools","ecosystem":"npm","purl":"pkg:npm/polymarket-trading-developer-tools"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.1.1","0.1.0"],"database_specific":{"indicators":{"package_integrity":[{"filename":"polymarket-trading-developer-tools-0.1.1.tgz","hashes":{"sha1":"a1493e002b8a2f1e9f9ef8434601898a13202808","sha512_sri":"sha512-pLnQf1/FnbmsA7yPNsbK3M8moT5lVjMDmD/SMgkMglTjzwCvUOULGFHTFHaPqzOxL6tCikY2iK6OnMYg/0lzJg=="}}],"evidence_files":[{"path":"scripts/install-check.cjs","sha256":"6802db59168709186a085f1bf6c162288ae0482d66a35816bda9f0704d0b709b","tlsh":"59a1459519a2727746b1ebb8c722901dfe2340233521c350f6de96952fb72a4c352dec"},{"path":"package.json","sha256":"fe954a4bec11a496bdd168d19d815ce5a0bff843f9d5e86af18cd23979e8baa8","tlsh":"6cf07d37da505d3624bc8f9d4e6c2540f8650b1f32b00d1bb1bb615c4fb2163045b739"}]},"cwes":[{"name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506"},{"name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506"},{"name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/polymarket-trading-developer-tools/MAL-2026-6692.json","iocs":{"domains":["polymarket-clob-service.vercel.app","pm-trading-dev-tools-be.vercel.app"]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}