Notifications
Clear all
Topic starter
02/08/2026 9:47 am
TL;DR: A malicious npm package impersonating Polymarket combined cloud credential harvesting, crypto-wallet theft, and RAT-style remote command execution, while also exposing the attacker’s own GitLab SSH keys in cleartext, according to OXSecurity. The pattern shows how package trust, browser extension access, and cloud token collection can converge into a single compromise path, making software supply chain governance and NHI control gaps visible at the same time.
NHIMG editorial — based on content published by OXSecurity: polymarket-kit npm Supply Chain Attack Combines Cloud Harvesting and a WebSocket RAT, Then Exposes Its Own GitLab Credentials
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when malicious npm packages are allowed to run on developer endpoints?
A: They can turn install-time trust into code execution, then harvest browser-stored secrets, cloud tokens, and local credentials before defenders detect the compromise.
Q: Why do developer endpoints create such high identity risk?
A: Developer endpoints often hold browser sessions, API tokens, cloud keys, and wallet material in one place.
Q: How do security teams know if secrets are being handled safely on endpoints?
A: Look for whether secrets are short-lived, isolated from general browsing and package execution, and revoked quickly when exposure is suspected.
Practitioner guidance
- Tighten package installation controls Restrict npm package execution on developer endpoints through allowlists, provenance checks, and malware scanning that inspects post-install scripts and external callbacks.
- Separate secrets from general developer desktops Move cloud tokens, API keys, and wallet-related credentials out of endpoints that also run arbitrary package code, and use short-lived access where possible.
- Monitor for WebSocket command channels Alert on unusual persistent outbound WebSocket connections, especially where they are paired with file collection, credential access, or remote command execution patterns.
What's in the full analysis
OXSecurity's full analysis covers the operational detail this post intentionally leaves for the source:
- Indicators of compromise for the polymarket-kit package, including the malicious host and exposed credential artefacts.
- The deobfuscated malware flow, including the WebSocket control path and command execution behaviour.
- The full list of targeted wallet extensions and desktop wallets, useful for threat hunting and triage.
- Recommended response steps for compromised crypto wallets and affected developer environments.
👉 Read OXSecurity's analysis of the polymarket-kit npm supply chain attack →
Polymarket-kit malware: what npm supply chain teams should watch now?
Explore further
02/08/2026 12:39 pm
Package trust has become an identity decision, not just a software supply chain decision. A malicious npm package does not merely deliver code, it inherits whatever execution and data access the developer endpoint already holds. That means package governance and credential governance now overlap, especially where browser-stored secrets, cloud tokens, and workstation identities coexist. Practitioners should treat package installation as a high-trust identity event.
A few things that frame the scale:
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
- 23.7% of organisations share secrets through insecure methods such as email or messaging applications, according to The 2024 Non-Human Identity Security Report.
A question worth separating out:
Q: Who is accountable when a supply chain package steals credentials and machine access?
A: Accountability usually sits across engineering, platform security, and identity teams because the failure spans software intake, endpoint execution, and credential governance. The right control owners are the teams that approve package trust, manage secret lifecycles, and define which identities may exist on developer workstations.
👉 Read our full editorial: Polymarket-kit npm supply chain attack exposes cloud and wallet data
