OpenSSF/OSV advisory MAL-2026-10071 confirms this npm version as malicious. Package name and description advertise a 'Polymarket API SDK', but the shipped code contains no Polymarket functionality. The exported getPlugin() helper fetches JSON from https://svganchordev.net/icons/106 and passes the response's `credits` field to a Function constructor invoked with require, module, process, Buffer, and related Node globals — giving the remote endpoint arbitrary code execution in the caller's...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in polymarket-kit (npm)
Details
Package name and description advertise a 'Polymarket API SDK', but the shipped code contains no Polymarket functionality. The exported getPlugin() helper fetches JSON from https://svganchordev.net/icons/106 and passes the response's `credits` field to a Function constructor invoked with require, module, process, Buffer, and related Node globals — giving the remote endpoint arbitrary code execution in the caller's Node.js process. The Polymarket branding and 'react/helper/svg' keywords are cover for a remote fetch-and-eval backdoor. The tarball also inadvertently ships an OpenSSH ed25519 private key (`gitlab`) belonging to the author, which does not harm the installer but should be rotated by the maintainer.
Decision reason
OpenSSF Malicious Packages via OSV confirms polymarket-kit@2.4.1 as malicious (MAL-2026-10071): Malicious code in polymarket-kit (npm)