MAL-2026-3182

    Dashboard / Malicious Package / MAL-2026-3182

    MAL-2026-3182

    Published: 29 Apr 2026Last Modified: 30 Apr 2026

    Summary: Malicious code in redeem-onchain-sdk (npm)

    Details: redeem-onchain-sdk is a malicious npm package impersonating a Polymarket on-chain SDK. It collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and a month of git commit history, then ships everything over a raw TCP socket to an AWS-hosted C2. Two triggers fire it: a require() side effect in the package's main entry point (added in v1.0.1) and a postinstall hook (added in v1.0.5). The payload lives in dist/proxy.js, later renamed dist/index5_test.js. Source: amazon-inspector (765d01eed7c5ad80c911fec6f2e1778fb2c14fa7165520416d85273858f7e3e3) The package redeem-onchain-sdk was found to contain malicious code.

    References: https://safedep.io/redeem-onchain-sdk-polymarket-npm-malware/

    Affected packages

    Package

    Name: redeem-onchain-sdk

    Purl: pkg:npm/redeem-onchain-sdk

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.0.7
    MAL-2026-3182 | CVE-DB