discovered
polymarket-claude-code is identified in the SafeDep analysis "Polymarket npm Packages Steal Crypto Wallet Keys". Nine coordinated npm packages target Polymarket traders with a social-engineered postinstall prompt that exfiltrates raw private keys to a Cloudflare Worker. The attacker published all packages within 30 seconds from a throwaway account.