{"answers":{"affected":"1 open source package ship an affected version, including polymarket-trader-apis.","exploited":"There is no known exploitation of MAL-2026-10072 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10072 is a malicious package in polymarket-trader-apis, published on 9 Jul 2026."},"fix_prompt":"MAL-2026-10072 is a malicious package: polymarket-trader-apis (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10072/ (Markdown: https://insights.sbomify.com/MAL-2026-10072/index.md)","id":"MAL-2026-10072","markdown":"https://insights.sbomify.com/MAL-2026-10072/index.md","name":"MAL-2026-10072","record":{"aliases":["GHSA-773r-gj6w-h338"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"polymarket-trader-apis@2.1.0 advertises itself as a Polymarket trading helper but its main entry is a remote code loader. The default-exported getPlugin fetches JSON from https://svganchordev.net/icons/108 and passes the response's `credits` field to `new Function('require','module','exports',...,'Promise', data.credits)`, then invokes it with `require`, `process`, `Buffer`, and other Node globals in scope — granting the remote operator arbitrary code execution in the caller's Node process. The code is wrapped in cover-story framing (an `IconProvider`/font-awesome CDN map referencing cloudflare/fastly/akamai and a `/ajax/libs/font-awesome/6.4.0/svgs/brands/` path) to make the loader appear to be an SVG icon fetcher, and the package keywords (`react`,`helper`,`svg`) contradict the stated Polymarket purpose. Declared dependencies (`@primno/dpapi`, `node-machine-id`, `better-sqlite3`, `sqlite3`) are consistent with second-stage credential/browser-database harvesting once the fetched payload executes. The remote endpoint is a non-first-party domain unrelated to Polymarket, the payload is opaque and author-mutable, and there is no integrity verification.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in polymarket-trader-apis (npm)","id":"MAL-2026-10072","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"polymarket-trader-apis","purl":"pkg:npm/polymarket-trader-apis","source":"MAL-2026-10072"}],"products":null,"published":"2026-07-09","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10072/"}