polymarket-gamma-apis@1.4.0

Analysis

A remote-code-execution dropper whose package name and README (claiming to be a "tailwindcss forms bundle") do not match its behaviour. The index.js getPlugin() fetches arbitrary JavaScript from hxxps://bet.slotgambit[.]com/icons/105 and executes it via new Function() with full Node.js globals (require, process, Buffer, console, fs); the malware activates when the package is imported. Its dependency list confirms credential-theft intent: @primno/dpapi (Windows DPAPI decryption for browser credentials), node-machine-id (machine fingerprinting), better-sqlite3/sqlite3 (reading browser SQLite credential stores), and socket[.]io-client (WebSocket C2 channel).