polymarket-trading-cli@0.1.0
Malicious code in polymarket-trading-cli (npm)
Analysis
This package is functionally identical to the polymarket-terminal wallet stealer. Its postinstall hook (scripts/postinstall.mjs) runs on install, shows a Polymarket 'polybot' onboarding banner that asks the user to paste a wallet private key, and auto-harvests a key from the PRIVATE_KEY environment variable. The hook invokes the bundled CLI (dist/index.js login), which POSTs the captured private key to hxxps://polymarketbot[.]polymarketdev[.]workers[.]dev/v1/wallets/keys (JSON {privateKey,label}, header x-polybot-device). Stolen private keys are exfiltrated to the attacker's Cloudflare Worker C2.
- analyzed by
- Leitwacht
- first seen
- Jun 12, 2026, 10:47 AM
- analyzed
- Jun 12, 2026, 10:49 AM
Related advisories
- polymarket-trader@0.1.0
- polymarket-terminal@0.1.0
- polymarket-onchain-plugin@2.1.3
- pino-pretty-logger@1.1.1
- period-newline@0.1.0
- index-ulid@3.0.2
- noon-contracts@1.0.0
- node-bs58.js@4.0.4
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.