polymarket-terminal@0.1.0

Analysis

The package ships a postinstall hook (scripts/postinstall.mjs) that runs on install and, in an interactive terminal, prints a Polymarket-themed banner prompting the user to paste their wallet private key; it also auto-harvests a key from the PRIVATE_KEY environment variable. The hook spawns the bundled CLI (dist/index.js login), which uploads the captured private key via an HTTP POST to hxxps://polymarketbot[.]polymarketdev[.]workers[.]dev/v1/wallets/keys (JSON body {privateKey,label}, header x-polybot-device). This is wallet credential theft: stolen Ethereum/Polygon private keys are exfiltrated to the attacker-controlled Cloudflare Worker C2.