Malicious npm package @polymarkets/clob-client-v2 — full host compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub's advisory database published a malware advisory (GHSA-j4hq-4959-hgrr, CWE-506 Embedded Malicious Code) for the npm package @polymarkets/clob-client-v2, which impersonates the legitimate Polymarket CLOB client. All versions (= 0) are affected and no patched version exists; the package should never be installed. GitHub states any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, harvested secrets and keys, and deployed additional persistence that survives package removal. The package sees roughly 279 downloads per month. Remediation requires removing the package, rotating all secrets and keys from a clean machine, and forensic review of affected hosts.
What to do
- Remove @polymarkets/clob-client-v2 from all projects and lockfiles and block it in your registry/proxy
- Rotate all secrets, API keys, tokens and credentials stored on any machine where it was installed, using a clean computer
- Rebuild affected machines from trusted images; check for persistence, as removal may not eliminate implanted malware
- Audit CI/CD and developer machines for the package and review logs for suspicious outbound activity
Sources
All live incidents on Threat Watch
