MAL-2026-3182 Malicious code in redeem-onchain-sdk (npm)
- Package
- redeem-onchain-sdk
- Registry
- npm
What is MAL-2026-3182?
MAL-2026-3182 is a malicious package in redeem-onchain-sdk, published on 29 Apr 2026.
Official description
redeem-onchain-sdk is a malicious npm package impersonating a Polymarket on-chain SDK. It collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and a month of git commit history, then ships everything over a raw TCP socket to an AWS-hosted C2. Two triggers fire it: a require() side effect in the package's main entry point (added in v1.0.1) and a postinstall hook (added in v1.0.5). The payload lives in dist/proxy.js, later renamed dist/index5_test.js.
The package redeem-onchain-sdk was found to contain malicious code.
What should I do about MAL-2026-3182?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.