Malicious code in neon-poly-utls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d32a00f9baf3245d9fb2850131a024274a409ca0eb90ac9db6e3e7dc37d379f The package's postinstall script reads a URL from package.json.homepage pointing to polymarket-clob-service.vercel.app/config/clob-math.json, fetches...

MAL-2026-10089 Malicious code in neon-poly-utls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d32a00f9baf3245d9fb2850131a024274a409ca0eb90ac9db6e3e7dc37d379f The package's postinstall script reads a URL from package.json.homepage pointing to polymarket-clob-service.vercel.app/config/clob-math.json, fetches...

MAL-2026-6719 Malicious code in ts-clob-math-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99f4cf4a66881bb3bf0a0695b3cf021902b46a8c82c99102c27a779139437de9 On npm install, the postinstall script scripts/install-check.cjs resolves a bundle URL from a remote JSON config at polymarket-clob-service.vercel.ap...

MAL-2026-6691 Malicious code in polymarket-clob-maths (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. polymarket-clob-maths uses a dropper technique: a postinstall hook fetches a remote bundle from trabalhos-flax.vercel.app and executes a syncSession function that runs a...

Malicious code in clob-client-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b36bbf14a743630a93ba7f8d7529d3fae8073f0f585af4343506be6248fc1b59 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

MAL-2026-6587 Malicious code in clob-client-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b36bbf14a743630a93ba7f8d7529d3fae8073f0f585af4343506be6248fc1b59 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

Malicious Package

Overview polymarket-clob-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-5585 Malicious code in polymarket-clob-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a40eb434e89ad381733b42cb87bd88d0da0913520a210fd4f6da175e1a115f9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in polymarket-clob-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a40eb434e89ad381733b42cb87bd88d0da0913520a210fd4f6da175e1a115f9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in clobprice.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in clob.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in @devcarron/clob (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

MAL-2026-4347 Malicious code in @devcarron/clob (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in polymarket-clob-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e0a3a7bbeb25fb478d59cdd4b62ebb34c13e8e236505813660e81abf61e74ec The package is published as polymarket-clob-client, an unscoped lookalike of the legitimate @polymarket/clob-client maintained by Polymarket, but the...

MAL-2026-4643 Malicious code in polymarket-clob-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e0a3a7bbeb25fb478d59cdd4b62ebb34c13e8e236505813660e81abf61e74ec The package is published as polymarket-clob-client, an unscoped lookalike of the legitimate @polymarket/clob-client maintained by Polymarket, but the...

MAL-2026-1942 Malicious code in clob-client-sdks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d71cb09660dc0e81eb08d723da80d7cbe9f2390137596cfead83820db53f0674 The package clob-client-sdks was found to contain malicious code. Source: ghsa-malware 2ff610e554b6569926182810264eb97b765d9c2fde7e3a53fc3c8e16388b79...

Malicious code in clob-client-sdks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d71cb09660dc0e81eb08d723da80d7cbe9f2390137596cfead83820db53f0674 The package clob-client-sdks was found to contain malicious code. Source: ghsa-malware 2ff610e554b6569926182810264eb97b765d9c2fde7e3a53fc3c8e16388b79...

Malicious code in clob-utils-sdks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f20ec3dfbb49223ad3bda64fdd9d0af3f65ea9e3c972fc04ad497f4ff39f30b9 The package clob-utils-sdks was found to contain malicious code. Source: ghsa-malware fea942e1b67d99fb05dcee5e06429f58255c03be72abcfd2d022c7c458f4dd8...

MAL-2026-1943 Malicious code in clob-utils-sdks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f20ec3dfbb49223ad3bda64fdd9d0af3f65ea9e3c972fc04ad497f4ff39f30b9 The package clob-utils-sdks was found to contain malicious code. Source: ghsa-malware fea942e1b67d99fb05dcee5e06429f58255c03be72abcfd2d022c7c458f4dd8...

Malicious Package

Overview clob-utils-sdks is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...