MAL-2026-10481

Dashboard / Malicious Package / MAL-2026-10481

MAL-2026-10481

Summary: Malicious code in polymarket-mcp-v2 (npm)

Details: polymarket-mcp-v2 is an information stealer and remote-access backdoor that runs automatically on `npm install`. It steals Solana keypairs, `.env` secrets and other credential files, and installs an attacker-controlled SSH key into `~/.ssh/authorized_keys`, then opens port 22 for persistent access. Any host that installed it should be treated as compromised: check `~/.ssh/authorized_keys` for an unrecognized key, check the firewall for a newly opened port 22, and rotate Solana keypairs, SSH keys and any secrets in reachable `.env` files. The payload is a redeployment of the levex-refa/lint-builder toolkit documented in the February 2026 dev-protocol GitHub organization compromise, against new C2 infrastructure. A postinstall hook (`node test.js`) requires index.js and calls two functions with no installer action. from_str_2 collects host identifiers, appends the attacker key to `~/.ssh/authorized_keys`, runs `sudo chown -R <user>:<user> ~/.ssh`, `sudo ufw enable`, `sudo ufw allow 22/tcp`, then recurses the filesystem for patterns fetched live from the C2 (`/api/scan-patterns`, `/api/block-patterns`) and uploads matches to `/api/v1`. from_str_1 does a narrower hardcoded search for id.json (Solana keypairs), config.toml and .env. The C2 (170.205.31.203:3001) served a Next.js panel titled "ENV Bot - HYPE"; a dev-mode error disclosed the operator path `C:\1\anti-server\bot-wallet-management-v1\`. Source: amazon-inspector (cbccd8ee43d5fefa17eb83c5528b66a52315351a404aa54c4a32d1af0dbf238e) The package's postinstall hook loads index.js and executes routines that (1) recursively scan the install directory for id.json,.env, env, config.toml and Config.toml and POST their contents to http://170.205.31.203:3001/api/v1; (2) fetch an attacker-supplied SSH public key from http://170.205.31.203:3001/api/ssh-key, append it to ~/.ssh/authorized_keys, chown the.ssh directory, then run `sudo ufw enable` and `sudo ufw allow 22/tcp` to expose port 22; and (3) fetch file-name patterns from the same host, enumerate the user's home directory (Unix) or all logical drives (Windows, via `wmic logicaldisk get name` with a PowerShell fallback), and batch-upload matching files to http://170.205.31.203:3001/api/v1 with username and platform metadata. Module names, endpoint URLs, and API paths are hidden behind \u00xx unicode escapes and reversed-string constructions to evade static review. The behavior combines install-time credential/file exfiltration with a persistent SSH remote-access backdoor.

References: https://www.npmjs.com/package/polymarket-mcp-v2/v/2.1.6, https://www.stepsecurity.io/blog/malicious-polymarket-bot-hides-in-hijacked-dev-protocol-github-org-and-steals-wallet-keys