Polymarket-kit npm supply chain attack exposes cloud and wallet data

At a glance

What this is: This is a supply chain malware analysis of a malicious npm package that steals wallet data, cloud credentials, and machine control, while also exposing the attacker’s own SSH keys.

Why it matters: It matters because identity and access controls around software packages, browser extensions, cloud tokens, and service credentials can fail together, giving attackers both data theft and remote execution paths.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read OXSecurity's analysis of the polymarket-kit npm supply chain attack

Context

Polymarket-kit is best understood as a supply chain compromise with an identity problem attached. A malicious npm package can reach developers, wallets, and cloud environments before defenders have time to validate what it is doing, and once it does, it can abuse secrets, tokens, and browser extension trust in the same session. That makes npm package hygiene, secret handling, and workload identity governance part of the same risk surface.

The article’s primary lesson is not about cryptocurrency alone. It is about how a package can blend credential harvesting, remote command execution, and cloud access collection into one delivery chain, which is exactly where NHI governance starts to matter for engineering teams. That starting position is increasingly typical for modern supply chain malware, not an edge case.

Key questions

Q: What breaks when malicious npm packages are allowed to run on developer endpoints?

A: They can turn install-time trust into code execution, then harvest browser-stored secrets, cloud tokens, and local credentials before defenders detect the compromise. The problem is not only malware delivery. It is that development endpoints often already hold identities and secrets that let an attacker move from package execution to account abuse quickly.

Q: Why do developer endpoints create such high identity risk?

A: Developer endpoints often hold browser sessions, API tokens, cloud keys, and wallet material in one place. Those assets behave like identities because they can authenticate actions without a human present, so compromise can lead to account takeover, pipeline access, or financial theft. The governance gap is treating them as local files instead of governed credentials.

Q: How do security teams know if secrets are being handled safely on endpoints?

A: Look for whether secrets are short-lived, isolated from general browsing and package execution, and revoked quickly when exposure is suspected. If long-lived tokens, SSH keys, or extension databases remain on general-purpose desktops, the organisation has a standing access problem rather than a containment problem.

Q: Who is accountable when a supply chain package steals credentials and machine access?

A: Accountability usually sits across engineering, platform security, and identity teams because the failure spans software intake, endpoint execution, and credential governance. The right control owners are the teams that approve package trust, manage secret lifecycles, and define which identities may exist on developer workstations.

Technical breakdown

How malicious npm packages turn install trust into execution

A malicious npm package exploits the basic trust developers place in package installation. In this case, the package delivered an obfuscated payload after contacting an external host, then executed that payload on the local machine. That gives the attacker a foothold before any obvious network indicators appear. Supply chain attacks work well here because the package does not need to defeat perimeter controls first, only the developer workflow that already has execution authority. Once installed, the package can search the host for secrets, browser data, and cloud artefacts.

Practical implication: software inventory and package allowlisting must cover install-time behaviour, not just published metadata.

Why cloud tokens and browser extensions become the same target set

The malware looks for cryptocurrency wallet extensions and cloud provider artefacts in the same runtime. That reflects a broader attacker logic: tokens, keys, and extension databases all represent reusable identity material, even if they serve different systems. When a package can decrypt local extension stores and collect cloud configuration data, it converts one endpoint compromise into access to multiple downstream services. This is an NHI problem as much as a malware problem, because the stolen material is usually machine-scoped or application-scoped identity.

Practical implication: isolate cloud secrets and browser-based identity stores from general developer endpoints wherever possible.

How WebSocket C2 extends compromise beyond theft

WebSocket gives the malware a persistent, bidirectional channel that can support both exfiltration and remote command execution. The article describes an exec function that lets the attacker run arbitrary commands over that channel, which turns the infected endpoint into an interactive remote access platform rather than a one-time steal. That matters because command-and-control is not just about data leakage. It becomes a live control plane for further discovery, lateral movement, and staged collection. The exposed attacker SSH keys also show how sloppy operational security can compound the threat picture.

Practical implication: detect persistent outbound WebSocket patterns and treat arbitrary command channels as high-risk remote access.

Threat narrative

Attacker objective: The attacker aims to steal crypto assets, harvest cloud access material, and retain remote control of infected endpoints for follow-on abuse.

1. Entry occurred through a malicious npm package that impersonated a legitimate crypto-related project and ran code during installation.
2. Credential access followed as the payload searched browser wallet extensions, local databases, and cloud provider artefacts for reusable secrets and configuration data.
3. Impact came from exfiltration of wallet data and cloud credentials, plus interactive remote command execution over WebSocket that expanded attacker control.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• GitHub Dependabot Breach — GitHub Dependabot tokens stolen and abused to push malicious commits to repositories.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Package trust has become an identity decision, not just a software supply chain decision. A malicious npm package does not merely deliver code, it inherits whatever execution and data access the developer endpoint already holds. That means package governance and credential governance now overlap, especially where browser-stored secrets, cloud tokens, and workstation identities coexist. Practitioners should treat package installation as a high-trust identity event.

Cloud credentials and wallet data are converging into a single theft surface. The malware targets crypto wallets, browser extension databases, and cloud provider artefacts using the same post-installation access. That convergence matters because the attacker does not need separate campaigns for each target class. The control gap is the absence of isolation between general developer activity and high-value identity material, which makes blast-radius management the real issue.

Persistent remote command channels are now part of the NHI threat model. A WebSocket-based C2 with exec capability effectively creates an attacker-operated control plane on the endpoint. That changes response priorities from simple malware removal to identity revocation, secret invalidation, and session containment. Practitioners should recognise that any machine holding secrets can become an access broker if outbound command channels are not constrained.

Standing secrets remain the easiest bridge from endpoint compromise to cloud compromise. Once a package can recover reusable keys or token material, the attacker no longer needs the original malware payload to stay resident. This is the same weakness seen in many NHI incidents: long-lived credentials create durable abuse windows. The governance lesson is that ephemeral access and narrow scoping are now baseline requirements, not refinements.

Named concept: developer endpoint identity sprawl. This article shows how one workstation can accumulate browser identities, cloud identities, wallet identities, and package execution trust at the same time. When those identities are not separated by policy and control plane, a single compromise can cross domains with little resistance. Practitioners should map which identities actually coexist on developer endpoints and reduce overlap aggressively.

From our research:

• Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
• 23.7% of organisations share secrets through insecure methods such as email or messaging applications, according to The 2024 Non-Human Identity Security Report.
• For deeper context on breach patterns, see The 52 NHI breaches Report for root cause patterns and control failures.

What this signals

Developer endpoint identity sprawl: the overlap of package execution trust, browser identity stores, and cloud credentials creates a single compromise surface that traditional endpoint controls do not fully separate. Teams should expect more supply chain malware to behave like identity theft tooling rather than simple malware, which makes credential lifecycle discipline and install-time trust validation equally important. For control mapping, align this risk to the MITRE ATT&CK Enterprise Matrix and the OWASP Non-Human Identity Top 10.

For security programmes, the practical shift is toward reducing the number of reusable secrets that ever land on developer machines. If an endpoint can collect cloud artefacts, wallet data, and SSH material in one pass, then secret sprawl has already become a breach multiplier. The operational answer is narrower access, faster revocation, and stronger separation between human activity and machine credentials.

This pattern also strengthens the case for treating local package execution as a policy boundary. A package that can call out over persistent WebSocket and execute commands is no longer just software delivery risk. It is an access path that must be governed with the same seriousness as any privileged remote administration channel.

For practitioners

• Tighten package installation controls Restrict npm package execution on developer endpoints through allowlists, provenance checks, and malware scanning that inspects post-install scripts and external callbacks.
• Separate secrets from general developer desktops Move cloud tokens, API keys, and wallet-related credentials out of endpoints that also run arbitrary package code, and use short-lived access where possible.
• Monitor for WebSocket command channels Alert on unusual persistent outbound WebSocket connections, especially where they are paired with file collection, credential access, or remote command execution patterns.
• Revoke exposed credentials immediately Treat any leaked SSH key, cloud token, or wallet credential as live until proven otherwise, then rotate or revoke the material and review the related session history.

Key takeaways

• A malicious npm package can combine code execution, secret harvesting, and remote command control in one compromise path.
• The main exposure is not just cryptocurrency theft but the overlap between developer trust, cloud credentials, and machine access.
• Teams should reduce standing secrets on endpoints, constrain package execution, and treat leaked identity material as immediately live.

Key terms

• Software Supply Chain Attack: A software supply chain attack targets the path software takes from source code to production. The attacker corrupts code, dependencies, build steps, or artifacts so that trusted delivery mechanisms spread malicious logic into environments that would otherwise reject direct intrusion.
• Remote Access Trojan: A remote access trojan is malware that gives an attacker interactive control over a compromised system after execution. It usually combines a loader, persistence and a command channel so the attacker can issue instructions, exfiltrate data or deploy additional payloads without repeatedly exploiting the target.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• WebSocket Command and Control: WebSocket command and control is a live attacker communication channel that supports two-way interaction between malware and a remote server. It can carry exfiltration, tasking, and execution commands over a persistent session, which makes the compromise look more like remote administration than one-time theft.

What's in the full analysis

OXSecurity's full analysis covers the operational detail this post intentionally leaves for the source:

• Indicators of compromise for the polymarket-kit package, including the malicious host and exposed credential artefacts.
• The deobfuscated malware flow, including the WebSocket control path and command execution behaviour.
• The full list of targeted wallet extensions and desktop wallets, useful for threat hunting and triage.
• Recommended response steps for compromised crypto wallets and affected developer environments.

👉 The full OXSecurity post covers the malware flow, exposed keys, and targeting details.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity security, and secrets management. It helps practitioners connect identity controls to the broader security programme they operate every day.