polygon-gamma-apis@1.5.2

Analysis

polygon-gamma-apis is a combosquat of the polymarket-clob-api SDK (the package's own README is a verbatim copy of the real SDK's documentation). The package contains a remote-code-execution dropper in index.js: the exported getPlugin() function fetches a JSON payload from hxxps://svganchordev[.]net/icons/111 (with the request header 'bearrtoken: logo') and passes the response's 'credits' field into a new Function() constructor injected with the full set of Node.js globals — including require (granting access to child_process, fs, and all system APIs). This allows the remote server to execute arbitrary code on any machine that requires this package. The host svganchordev[.]net serves the remotely-controlled second-stage payload. The package also ships dependencies suitable for system fingerprinting (node-machine-id) and Windows credential access (@primno/dpapi), alongside socket[.]io-client, better-sqlite3, express, and axios, providing a full attack toolchain.