polymarket-apis @1.1.0

Summary

The package impersonates the Polymarket brand (name polymarket-apis , author polymarket ) but contains no Polymarket API integration. Its exported getPlugin function fetches JSON from https://svganchordev.net/icons/<token> and passes the response's credits field to the JavaScript Function constructor, executing the returned bytes with full Node context (require, module, exports, process, Buffer, __dirname). The remote URL is assembled from split string constants ( protocol + separator + domain + path ) and the surrounding code is framed as a benign icon/CDN helper ( IconProvider , bearrtoken: 'logo' ) to disguise the eval. Because the fetched content is attacker-controlled and mutable, any caller invocation of the exported API runs arbitrary code on the installer with Node privileges. Declared runtime dependencies ( @primno/dpapi , node-machine-id , better-sqlite3 ) are consistent with Windows credential and browser-data stealer payloads that the remote code can load. Package keywords ( react , helper , svg ) are inconsistent with the advertised Polymarket SDK purpose, confirming the cover-story framing.

Source: amazon-inspector (cd77c8861490c0b5607b4029f8f9e51f12efb83a6696fc51b953b0a3cde1356b)