@polymarkets/clob-client-v2@1.0.2

Analysis

@polymarkets/clob-client-v2@1.0.2 impersonates the legitimate Polymarket CLOB client SDK (@polymarket/clob-client) using a combosquat scoped name, and ships a package.json whose dependency list resolves a real dependency from a look-alike registry host instead of the npm registry: "typescript-eslint": "hxxps://registrynpmjs[.]to/typescript-eslint-8[.]58[.]2[.]tgz". Any install of this package fetches and installs an attacker-controlled tarball from registrynpmjs.to (a typosquat of registry[.]npmjs[.]org) as part of the dependency tree, giving the operator arbitrary code execution in the installer's environment at install time. The rest of the package is a near-verbatim copy of the genuine SDK (same description, repository URL, MIT license, viem/axios/@ethersproject dependency set, dist/index.cjs + dist/index.js bundles), so the malicious dependency entry is the only deviation from the upstream code. The package declares no lifecycle hooks and the bundled JS contains no obfuscation, eval/atob, child_process, or credential-harvesting code — the attack is delivered entirely through the substituted dependency URL. IOC: registrynpmjs.to (hxxps://registrynpmjs[.]to/typescript-eslint-8[.]58[.]2[.]tgz).