polymarket-mcp-v2
This report shows the evidence for polymarket-mcp-v2@2.1.6, the only known version.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiDirect source inspection confirms unconsented install-time exfiltration and persistence unrelated to Polymarket/MCP behavior. This is concrete malicious behavior, not a noisy static label.
Static reason
One or more suspicious static signals were detected.
Trigger
npm install via postinstall node test.js, or runtime calls to exported functions
Impact
theft of project/home files, remote access persistence, firewall SSH opening attempt
Mechanism
credential/file exfiltration plus SSH authorized_keys persistence
Attack narrative
The package postinstall runs test.js, which imports index.js and invokes both exported routines. One routine recursively finds local config/env files and uploads their contents to 170.205.31.203. The other retrieves remote scan rules and an SSH key, scans user storage, uploads matches with host metadata, and attempts to append the fetched SSH key to authorized_keys while opening SSH via ufw.
AI rationale
Direct source inspection confirms unconsented install-time exfiltration and persistence unrelated to Polymarket/MCP behavior. This is concrete malicious behavior, not a noisy static label.
Evidence
package.jsontest.jsindex.jsid.jsonconfig.tomlConfig.tomlenv.env$HOME/.ssh/authorized_keys
Network endpoints5
170.205.31.203:3000/api/v1170.205.31.203:3001/api/ssh-key170.205.31.203:3001/api/scan-patterns170.205.31.203:3001/api/block-patterns170.205.31.203:3001/api/v1
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs postinstall: node test.js
- test.js imports package main and calls from_str_2() and from_str_1() during install
- index.js from_str_1 recursively reads cwd files matching id.json, config.toml, Config.toml, env, .env and POSTs them
- index.js from_str_2 fetches remote scan/block patterns, scans home/drives, and uploads matched files with username/platform metadata
- index.js fetches a remote SSH key and on Linux appends it to $HOME/.ssh/authorized_keys
- index.js runs sudo chown and sudo ufw commands after SSH key mutation
Evidence against
- No benign Polymarket/MCP functionality is present in package sources
- No user consent gate before install-time file theft or SSH persistence
Behavioral surface
ChildProcessNetworkShell
MinifiedProtestware
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node test.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•Runtime dependency names matching Node built-ins: child_process, os
High
Node Builtin Dependency Squat
Package declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkgindex.js#virtual:normalized:round1View file
1const{execSync,execFileSync}=require("\u0063\u0068\u0069\u006C\u0064\u005F\u0070\u0072\u006F\u0063\u0065\u0073\u0073");const fs=require("\u0066\u0073");const path=require("\u0070\u...
Medium
Install Persistence
Source writes installer persistence such as shell profile or service configuration.
index.js#virtual:normalized:round1View on unpkg · L1Findings
2 High3 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
HighNode Builtin Dependency Squatpackage.json
MediumNetwork
MediumInstall Persistenceindex.js#virtual:normalized:round1
MediumProtestware
LowScripts Present
Affected versions and remediation
This report applies to polymarket-mcp-v2@2.1.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing polymarket-mcp-v2@2.1.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.