SafeDep found nine npm packages published within minutes of one another under names that imitated Polymarket trading utilities. All nine shared the same bundled payload and a common GitHub credibility layer. Two names, `polymarket-claude-code` and `polymarket-ai-agent`, were explicitly tailored to AI-assisted development workflows, which makes the AI…
Inspect the ClaimsCase · DiggingBeagle record
Fake Polymarket npm tools were built to exfiltrate wallet keys and target AI coding workflows
SafeDep found nine fake Polymarket npm packages with a shared payload that collected Ethereum private keys and sent them to attacker infrastructure when the relevant paths executed. Two names, polymarket-claude-code and polymarket-ai-agent, were tailored to AI-assisted development workflows, but public evidence does not show that an AI model hallucinated or recommended them.
Scope
Nine npm packages published on May 20, 2026 by the polymarketdev account and analyzed by SafeDep. This Case focuses on the two AI-targeted names within the shared campaign and the common private-key exfiltration behavior. It does not claim that a model-generated hallucination caused installation or that exfiltrated keys were used to move victim funds.
At a glance
The Polymarket campaign shows why AI-oriented naming and slopsquatting should not be merged. The attacker can target developers who use coding assistants simply by publishing plausible AI-related package names; no hallucinated namespace is required. The decisive control is therefore not only better model accuracy. Package provenance, publisher history,…
Read the implicationsThe public evidence does not establish that a coding model or agent recommended polymarket-claude-code or polymarket-ai-agent to a victim. SafeDep demonstrates private-key collection and exfiltration capability but does not document a named victim wallet transfer or quantified financial loss. The public analysis does not provide a reliable victim count for…
Limits and uncertaintyFull account
SafeDep found nine npm packages published within minutes of one another under names that imitated Polymarket trading utilities. All nine shared the same bundled payload and a common GitHub credibility layer. Two names, polymarket-claude-code and polymarket-ai-agent, were explicitly tailored to AI-assisted development workflows, which makes the AI targeting material without establishing that a model hallucinated either identifier.
The execution path has an important prerequisite. SafeDep reports that the install-time script checks whether it is running in an interactive terminal. In a noninteractive or CI installation it prints a success message and exits instead of starting the wallet-onboarding flow. In the interactive login path, the code loads .env before asking for a key; if PRIVATE_KEY is already present in the environment or local configuration, the prompt can be skipped. When a key is collected, the package sends the raw value in plaintext JSON over HTTPS to an attacker-controlled Cloudflare Worker. TLS protects the network transport, but the attacker receives the usable private key.
npm v12 reduces one automatic route because dependency lifecycle scripts such as postinstall are blocked unless explicitly allowed. That changes exploitability for the install-hook path, but it does not establish package trust and it does not prove that these packages were ever recommended by a model. The public SafeDep analysis demonstrates malicious key-exfiltration capability, not a documented victim wallet drain.
Claims & evidence
CLM-POLYMARKET-KEY-EXFILThe shared payload collected Ethereum private keys from an interactive prompt or local environment data and sent the raw key to attacker-controlled infrastructure.supported
Basis: reported finding
- supportsPolymarket npm Packages Steal Crypto Wallet Keysrole not specified
Sections 'Private Key Collection' and 'Data Exfiltration'.
CLM-POLYMARKET-NINE-PACKAGESSafeDep identified nine npm packages published by the same account with a shared payload and Polymarket-themed package names.supported
Basis: reported finding
- supportsPolymarket npm Packages Steal Crypto Wallet Keysrole not specified
TL;DR and 'Package Overview', including the nine-package list and shared payload hash.
CLM-POLYMARKET-AI-TARGETED-NAMESSafeDep reports that the package names polymarket-claude-code and polymarket-ai-agent were selected to target developers using AI-assisted coding workflows.supported
Basis: reported finding
- supportsPolymarket npm Packages Steal Crypto Wallet Keysrole not specified
TL;DR, 'Package Overview' and conclusion describing the AI-tooling-specific package names.
CLM-POLYMARKET-EXECUTION-PREREQUISITESafeDep reports that the packages' postinstall onboarding flow runs only in an interactive terminal; inside the login path, the code loads local environment data before prompting, so an existing PRIVATE_KEY value can be collected without the masked prompt and sent to attacker infrastructure.supported
Basis: reported finding
- supportsPolymarket npm Packages Steal Crypto Wallet Keysrole not specified
Sections 'Execution Trigger', 'Private Key Collection' and 'Data Exfiltration', including the interactive-TTY check, .env loading and raw-key POST request.
Implications
The Polymarket campaign shows why AI-oriented naming and slopsquatting should not be merged. The attacker can target developers who use coding assistants simply by publishing plausible AI-related package names; no hallucinated namespace is required. The decisive control is therefore not only better model accuracy. Package provenance, publisher history, execution approval and secret isolation still matter when the package name itself is deliberate.
The interaction with npm v12 is also bounded. Blocking unapproved lifecycle scripts can stop this specific postinstall trigger before its onboarding flow starts, but it does not make the package safe if a user or agent later approves scripts or explicitly runs package code. Separating wallet keys and signing authority from development environments limits the consequence if those earlier checks fail.
Unknowns and contradictions
- The public evidence does not establish that a coding model or agent recommended polymarket-claude-code or polymarket-ai-agent to a victim.
- SafeDep demonstrates private-key collection and exfiltration capability but does not document a named victim wallet transfer or quantified financial loss.
- The public analysis does not provide a reliable victim count for the nine-package campaign.
- The postinstall onboarding path requires an interactive terminal according to SafeDep; the public report does not establish how often real installations satisfied that prerequisite.
- Current npm v12 blocks unapproved dependency lifecycle scripts by default, so automatic postinstall execution depends on npm version or an explicit allow decision.
Sources and citation
Material revision history
- Oct 7, 2026 · Canonical change recorded · new in release · revision 88