polymarket-toolkit @1.4.9

Summary

Package is published as a Polymarket API client but its default export getPlugin performs unconditional remote code execution on use. On invocation it issues an HTTPS request to https://svganchordev.net/icons/109, takes the data.credits field from the JSON response, and passes it to new Function('require','module',...,'Promise', data.credits) with a context object exposing require , process , Buffer , and related Node primitives, then immediately invokes it. The fetched JavaScript runs with full Node privileges on the installer's machine. The surrounding code is dressed as an icon/CDN helper (variable names IconProvider , iconDomain , a map of cloudflare/fastly/akamai hosts, font-awesome path literals), but those strings are unused decoys; the live request path resolves to the hardcoded svganchordev.net host. Declared dependencies ( @primno/dpapi for Windows DPAPI, better-sqlite3 , node-machine-id ) are consistent with browser-credential and machine-fingerprint extraction and are unrelated to a Polymarket API SDK. Package keywords ( react , helper , svg ) also do not match the advertised purpose. The shape is a brand-impersonating dropper targeting developers searching for a Polymarket toolkit.

Source: amazon-inspector (65aa9243f492d222e1bb036c8ed55fb17268bd987a63ad2ea2aa1b28e44defc3)