Polymarket Trader Funds at Risk: DPRK npm Package Steals Wallet Keys and Installs SSH Backdoor
On April 10, 2026, a malicious npm package named [email protected] was published, targeting developers running automated trading bots on Polymarket, a prediction market platform with $477 million in open interest. The package executes four attack chains upon import: system fingerprinting, SSH backdoor installation on Linux hosts, filesystem exfiltration, and targeted theft of Polymarket CLOB API credentials and Ethereum/Polygon wallet private keys. The payload runs at require() time without install hooks and specifically hunts SDK source files like createClobClient.ts and clob.ts. An SSH public key is written to authorized_keys for persistent access. The attacker can drain USDC balances directly using stolen L1 private keys. Attribution points to DPRK's Famous Chollima (Lazarus Group) based on TTPs matching the TraderTraitor campaign and publisher email correlation with known DPRK infrastructure.
Pulse ID: 69dd07b82c8afdcdfda7a898
Pulse Link: https://otx.alienvault.com/pulse/69dd07b82c8afdcdfda7a898
Pulse Author: AlienVault
Created: 2026-04-13 15:11:52
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#BackDoor #CyberSecurity #DPRK #Email #InfoSec #Lazarus #Linux #NPM #OTX #OpenThreatExchange #RAT #RCE #SSH #bot #developers #AlienVault