@polymarkets/clob-client-v2@1.0.6

Analysis

The package `@polymarkets/clob-client-v2` (a combosquat of the legitimate `@polymarket/clob-client`) declares its `inquirer` dependency as a direct tarball URL hosted on `hxxps://registrynpmjs[.]to/inquirer-14[.]0[.]2[.]tgz`. `registrynpmjs.to` is a typosquat of the official npm registry host `registry[.]npmjs[.]org`; installing this package causes npm to download and execute the `inquirer` dependency from that attacker-controlled lookalike registry domain rather than the official registry. The bundled client code itself is a standard Polymarket CLOB API client with no install hooks, but the dependency redirect means the attacker controls the code that runs when the package is installed and used.