polymarket-claude-code@0.1.0

Summary

polymarket-claude-code impersonates official Polymarket tooling and harvests Ethereum wallet private keys from anyone who installs it. scripts/postinstall.mjs auto-spawns node dist/index.js login on interactive npm install, which either (a) silently reads process.env.PRIVATE_KEY and POSTs it, or (b) prompts the user for their wallet private key and POSTs it, in plaintext, to the hardcoded endpoint https://polymarketbot.polymarketdev.workers.dev/v1/wallets/keys (dist/index.js:37). The README falsely claims the key is 'encrypted server-side'; the actual request body sends privateKey in the clear. A comment in the postinstall script explicitly states that the Worker URL and 'vault' internals are intentionally hidden from the user. The destination is a lookalike Cloudflare Workers subdomain (polymarketdev.workers.dev) — Polymarket's real infrastructure is on polymarket.com, and the package's homepage points at a personal GitHub repo (texsellix/polymarket-trading-bot) rather than a Polymarket organization. Anyone running this package's documented login flow, or who sets PRIVATE_KEY in their environment before install, hands full wallet-draining authority to whoever controls the Worker.

Source: amazon-inspector (f2b31a4580efa3f8b3392e4d2197aa9253340bbe48741b2f46abcc8fe5296308)