{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "scripts/install-check.cjs",
              "sha256": "6802db59168709186a085f1bf6c162288ae0482d66a35816bda9f0704d0b709b",
              "tlsh": "59a1459519a2727746b1ebb8c722901dfe2340233521c350f6de96952fb72a4c352dec"
            },
            {
              "path": "package.json",
              "sha256": "fe954a4bec11a496bdd168d19d815ce5a0bff843f9d5e86af18cd23979e8baa8",
              "tlsh": "6cf07d37da505d3624bc8f9d4e6c2540f8650b1f32b00d1bb1bb615c4fb2163045b739"
            }
          ],
          "package_integrity": [
            {
              "filename": "polymarket-trading-developer-tools-0.1.1.tgz",
              "hashes": {
                "sha1": "a1493e002b8a2f1e9f9ef8434601898a13202808",
                "sha512_sri": "sha512-pLnQf1/FnbmsA7yPNsbK3M8moT5lVjMDmD/SMgkMglTjzwCvUOULGFHTFHaPqzOxL6tCikY2iK6OnMYg/0lzJg=="
              }
            }
          ]
        },
        "iocs": {
          "domains": [
            "polymarket-clob-service.vercel.app",
            "pm-trading-dev-tools-be.vercel.app"
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "polymarket-trading-developer-tools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "0.1.1",
        "0.1.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://safedep.io"
      ],
      "name": "SafeDep",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007883",
        "import_time": "2026-07-01T21:04:19.939195348Z",
        "modified_time": "2026-07-01T20:37:07Z",
        "sha256": "943cf975d53a524e72fcbc2427626779099e58117534c29f3245edf33c164240",
        "source": "amazon-inspector",
        "versions": [
          "0.1.1"
        ]
      },
      {
        "id": "IN-MAL-2026-007882",
        "import_time": "2026-07-01T21:04:19.873339428Z",
        "modified_time": "2026-07-01T20:36:59Z",
        "sha256": "b81db3cfbdf6d7b0879b6aaf3ad13a458141edfafa53074658911c9203e55dca",
        "source": "amazon-inspector",
        "versions": [
          "0.1.0"
        ]
      }
    ]
  },
  "details": "Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. `polymarket-trading-developer-tools` uses a dropper technique: a `postinstall` hook downloads configuration from `pm-trading-dev-tools-be.vercel.app` and exfiltrates data to the shared C2 `polymarket-clob-service.vercel.app`. The payload harvests cryptocurrency wallet vaults, browser credentials, SSH keys, AWS credentials, developer secrets, shell history, and password manager databases.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b81db3cfbdf6d7b0879b6aaf3ad13a458141edfafa53074658911c9203e55dca)\nOn `npm install`, scripts/install-check.cjs runs as a postinstall hook and performs a fetch-and-execute chain controlled by a remote server. It requests a JSON config from pm-trading-dev-tools-be.vercel.app, reads a bundle URL from the response, downloads a.tgz to.peer/, extracts it, runs `npm install --omit=dev` inside the extracted directory (which executes arbitrary lifecycle scripts of arbitrary fetched dependencies), then require()s the extracted peer-math.js and invokes syncSession(). The bundle URL is server-chosen per request, unpinned, unverified by hash or signature, and the publisher does not match Polymarket. The package name (polymarket-trading-developer-tools@0.1.0) impersonates the Polymarket developer ecosystem while the README self-identifies as polymarket-stake-math with a fabricated 3.x changelog, and the dropper is framed as a routine `peer dependency check` (env vars PSM_PEER_URL / PSM_SYNC_CONFIG / KELLY_PEER_CONFIG, log tag `[polymarket-stake-math] install check skipped`) despite the package shipping only a ~40-line self-contained math helper with no real peer concept. Result: any developer running `npm install` on this package executes attacker-controlled code under their user account.\n",
  "id": "MAL-2026-6692",
  "modified": "2026-07-01T21:06:11Z",
  "published": "2026-06-30T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://safedep.io/defi-infostealer-fake-arbitrage-bot-npm/"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/polymarket-trading-developer-tools/v/0.1.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/polymarket-trading-developer-tools/v/0.1.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in polymarket-trading-developer-tools (npm)"
}