@polymarkets/clob-client-v2

{"modified":"2026-08-14T20:07:11Z","published":"2026-08-14T20:07:11Z","schema_version":"1.7.4","id":"MAL-2026-14050","summary":"Malicious code in @polymarkets/clob-client-v2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7e06fdabf4b8b56bb40b4656a1a254801f37bef08278111f59814e375be3e7dc)\npackage.json for @polymarkets/clob-client-v2 declares its inquirer dependency as an HTTPS tarball URL on registrynpmjs.to, a lookalike of the real npm registry (registry.npmjs.org): \"inquirer\": \"https://registrynpmjs.to/inquirer-14.0.2.tgz\". On npm install, npm fetches and installs whatever tarball that host serves as inquirer into node_modules, so the operator of registrynpmjs.to controls the code that runs via inquirer's install lifecycle and on first require. The package is also published under the scope @polymarkets, a one-character variation of the legitimate Polymarket scope @polymarket, consistent with a typosquat lure whose delivery vector is the redirected dependency.\n","affected":[{"package":{"ecosystem":"npm","name":"@polymarkets/clob-client-v2"},"versions":["1.0.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"1dfe0c6ca840a057a4cd92b07fad8d18e346fbe4766734eb89e47154b9625852","tlsh":"b241ab54cc65ceb305c426e9dc7a8a4aa13144074c50fd0973ce462d4f8c26f25feaae"}],"package_integrity":[{"filename":"clob-client-v2-1.0.6.tgz","hashes":{"sha1":"b18950226b10cb609c0fbdf72a574ba1cbb5e645","sha512_sri":"sha512-5xvVWKCE7TzFPLq2ZvMo6F2K2FLZSKPjAwdRkliXBdmaeCqe+82jn0ZXrNyrr6tKHdq96x1gWaqrBHDwOd+bbQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@polymarkets/clob-client-v2/v/1.0.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017928","import_time":"2026-08-14T20:14:23.595629659Z","modified_time":"2026-08-14T20:07:11Z","sha256":"7e06fdabf4b8b56bb40b4656a1a254801f37bef08278111f59814e375be3e7dc","source":"amazon-inspector","versions":["1.0.6"]}]}}