polymarket-apis@1.1.0

Analysis

polymarket-apis@1.1.0 is a combosquat package impersonating the Polymarket API SDK. The exported getPlugin() function fetches remote JavaScript code from hxxps://svganchordev[.]net/icons/{token} and executes it via the Function constructor with full Node.js runtime access (require, process, Buffer, child_process). The fetched response field "data.credits" is the executed payload. The package ships dependencies for credential theft: @primno/dpapi (Windows DPAPI credential decryption), better-sqlite3 (browser credential database access), node-machine-id (system fingerprinting), and socket[.]io-client (C2 communications). Any code importing and calling getPlugin() will download and execute an arbitrary second-stage payload from the C2 host svganchordev[.]net.