polymarket-mcp-v2

{"schema_version":"1.7.4","id":"MAL-2026-10481","published":"2026-07-11T00:00:00Z","modified":"2026-07-30T23:12:27.685952017Z","summary":"Malicious code in polymarket-mcp-v2 (npm)","details":"polymarket-mcp-v2 is an information stealer and remote-access backdoor that runs automatically on `npm install`. It steals Solana keypairs, `.env` secrets and other credential files, and installs an attacker-controlled SSH key into `~/.ssh/authorized_keys`, then opens port 22 for persistent access. Any host that installed it should be treated as compromised: check `~/.ssh/authorized_keys` for an unrecognized key, check the firewall for a newly opened port 22, and rotate Solana keypairs, SSH keys and any secrets in reachable `.env` files.\n\nThe payload is a redeployment of the levex-refa/lint-builder toolkit documented in the February 2026 dev-protocol GitHub organization compromise, against new C2 infrastructure. A postinstall hook (`node test.js`) requires index.js and calls two functions with no installer action. from_str_2 collects host identifiers, appends the attacker key to `~/.ssh/authorized_keys`, runs `sudo chown -R <user>:<user> ~/.ssh`, `sudo ufw enable`, `sudo ufw allow 22/tcp`, then recurses the filesystem for patterns fetched live from the C2 (`/api/scan-patterns`, `/api/block-patterns`) and uploads matches to `/api/v1`. from_str_1 does a narrower hardcoded search for id.json (Solana keypairs), config.toml and .env. The C2 (170.205.31.203:3001) served a Next.js panel titled \"ENV Bot - HYPE\"; a dev-mode error disclosed the operator path `C:\\1\\anti-server\\bot-wallet-management-v1\\`.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cbccd8ee43d5fefa17eb83c5528b66a52315351a404aa54c4a32d1af0dbf238e)\nThe package's postinstall hook loads index.js and executes routines that (1) recursively scan the install directory for id.json,.env, env, config.toml and Config.toml and POST their contents to http://170.205.31.203:3001/api/v1; (2) fetch an attacker-supplied SSH public key from http://170.205.31.203:3001/api/ssh-key, append it to ~/.ssh/authorized_keys, chown the.ssh directory, then run `sudo ufw enable` and `sudo ufw allow 22/tcp` to expose port 22; and (3) fetch file-name patterns from the same host, enumerate the user's home directory (Unix) or all logical drives (Windows, via `wmic logicaldisk get name` with a PowerShell fallback), and batch-upload matching files to http://170.205.31.203:3001/api/v1 with username and platform metadata. Module names, endpoint URLs, and API paths are hidden behind \\u00xx unicode escapes and reversed-string constructions to evade static review. The behavior combines install-time credential/file exfiltration with a persistent SSH remote-access backdoor.\n","affected":[{"package":{"name":"polymarket-mcp-v2","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["2.1.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"polymarket-mcp-v2-2.1.6.tgz","hashes":{"sha1":"cb215c192332b668d419e78ceab38b0312fc5ccc","sha512_sri":"sha512-r6oe5jaE+YS6sC4b+IhniOCikiFGRbb5lq01N3Sfz8JvpXpbTFg7SNb+LqPgZbz1x0VR9Xalm+uWlQRKSZVb3g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/polymarket-mcp-v2/v/2.1.6"},{"type":"ARTICLE","url":"https://www.stepsecurity.io/blog/malicious-polymarket-bot-hides-in-hijacked-dev-protocol-github-org-and-steals-wallet-keys"}],"database_specific":{"iocs":{"ips":["170.205.31.203"],"urls":["http://170.205.31.203:3001/api/ssh-key","http://170.205.31.203:3001/api/scan-patterns","http://170.205.31.203:3001/api/block-patterns","http://170.205.31.203:3001/api/v1","http://170.205.31.203:3001/dashboard"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-010298","import_time":"2026-07-13T20:29:53.907647298Z","modified_time":"2026-07-13T19:44:16Z","sha256":"cbccd8ee43d5fefa17eb83c5528b66a52315351a404aa54c4a32d1af0dbf238e","source":"amazon-inspector","versions":["2.1.6"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"skb1209","type":"FINDER"}]}