# Polymarket Trap: fake arbitrage bot leads to a 30-package npm infostealer

> SafeDep and Panther jointly disclosed the "Polymarket Trap" on 2026-07-17: a fake `Trum3it/polymarket-arbitrage-bot` GitHub repo (36 stars, 53 forks) whose `package.json` declares `clob-client-math` as a peer utility that is never `import`ed. The 30-package cluster spans 10 coordinated npm accounts under two profiles - Polymarket / CLOB SDK impersonators (`clob-client-math`, `polymarket-stake-math`, `polymarket-trade` and siblings) and DeFi-math typosquats (`bn-lint`, `ts-precision`, `decimal-format-utils`). A `postinstall` hook drops a 2,787–2,887-line JavaScript infostealer that harvests crypto wallets, browser vaults, SSH keys, cloud tokens, and password-manager databases.

- Published: 2026-07-17
- Last updated: 2026-07-27
- Severity: high
- Kind: Typosquat - A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK.
- Ecosystems: npm
- Scope: 12 packages, 29 compromised versions
- Tags: typosquat, infostealer, credential-theft, crypto-wallet-drain
- Also known as: Polymarket Trap, clob-client-math cluster
- Detected by: SafeDep, Panther, StepSecurity
- Incident ID: npm-2026-07-17-polymarket-trap-clob-client-math

## Affected packages (12)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [bn-lint](https://dependencywatch.io/package/npm/bn-lint) | npm | 3.0.6, 3.0.8 |
| [clob-client-math](https://dependencywatch.io/package/npm/clob-client-math) | npm | 1.0.0, 1.0.1 |
| [decimal-format-utils](https://dependencywatch.io/package/npm/decimal-format-utils) | npm | 1.0.0, 1.0.1 |
| [polymarket-ai-agent](https://dependencywatch.io/package/npm/polymarket-ai-agent) | npm | 0.1.0, 0.1.1 |
| [polymarket-auto-trade](https://dependencywatch.io/package/npm/polymarket-auto-trade) | npm | 0.1.0, 0.1.1 |
| [polymarket-bot](https://dependencywatch.io/package/npm/polymarket-bot) | npm | 0.1.0, 0.1.1 |
| [polymarket-claude-code](https://dependencywatch.io/package/npm/polymarket-claude-code) | npm | 0.1.0, 0.1.1 |
| [polymarket-copy-trading](https://dependencywatch.io/package/npm/polymarket-copy-trading) | npm | 0.1.0, 0.1.1 |
| [polymarket-stake-math](https://dependencywatch.io/package/npm/polymarket-stake-math) | npm | 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.5.0, 3.5.1 |
| [polymarket-stake-maths](https://dependencywatch.io/package/npm/polymarket-stake-maths) | npm | 3.1.0, 3.2.0, 3.3.0, 3.5.2 |
| [polymarket-trade](https://dependencywatch.io/package/npm/polymarket-trade) | npm | 0.1.0, 0.1.1 |
| [ts-precision](https://dependencywatch.io/package/npm/ts-precision) | npm | 3.7.2 |

## What happened

On 2026-07-17 SafeDep published *The Polymarket Trap*, tying 30 malicious npm packages spread across 10 coordinated publisher accounts to a single fake GitHub repository - `Trum3it/polymarket-arbitrage-bot` - that had accumulated 36 stars and 53 forks before a public issue (`Trum3it/polymarket-arbitrage-bot#2`, filed 2026-06-30) flagged the malicious `clob-client-math` dependency that was declared but never `import`ed in the bot's source. Panther independently published a version-by-version teardown of the sibling package `polymarket-stake-math` on the same day.

## Delivery: repo → npm install → postinstall dropper → infostealer

The repository advertises a TypeScript bot for Polymarket's 5-minute crypto prediction markets, promising a "late-window resolution snipe" strategy with annual returns above $80,000 - bait tuned for retail DeFi traders. The setup instructions require creating a `.env` file with `POLYMARKET_PRIVATE_KEY` BEFORE `npm install`, so the wallet's raw private key is on disk when the infostealer runs. Nine of the ten npm accounts use a `postinstall` hook running `scripts/install-check.cjs` (or the sibling variant `scripts/verify-peer.cjs`); the tenth uses a delayed require-time dropper. In every variant, the C2 URL is read from the package's `homepage` field rather than hardcoded in the JavaScript, defeating string-search static analysis on the tarball.

## Payload: 2,787–2,887-line JavaScript infostealer

The second stage is a 2,787- to 2,887-line JavaScript infostealer that sweeps crypto wallet vaults (MetaMask, Phantom, Solflare, OKX Wallet, Coinbase Wallet, TrustWallet, Backpack, TronLink), browser cookies and saved passwords (Chrome, Firefox, Brave), developer secrets (SSH private keys, AWS credentials, `.npmrc` tokens, `.pypirc`, Docker config, GPG keyrings), shell history (bash/zsh/fish/PowerShell), and password-manager databases (Bitwarden vault export, KeePass `.kdbx`, 1Password `.1pux`). Panther traced `polymarket-stake-math` version escalation: six versions in ~12 hours on 2026-06-23 starting with a clean Kelly-criterion math library, then injecting `collector.js` in a later version, then in `v3.5.0` swapping to a `sync-peer.cjs` dropper that fetches a pinned payload build (`v3.4.0`) from the registry and overwrites the installed package files at runtime.

## Package profiles

- **Polymarket / CLOB SDK impersonators** - `clob-client-math`, `polymarket-stake-math`, `polymarket-trade`, `polymarket-bot`, `polymarket-copy-trading`, `polymarket-auto-trade`, `polymarket-claude-code`, `polymarket-ai-agent`. Targets developers wiring up to the legitimate `@polymarket/clob-client` SDK.
- **Generic DeFi-math typosquats** - `decimal-format-utils`, `bn-lint`, `ts-precision`. Targets any project doing decimal math for on-chain balances.

## Timeline

- **2026-05-20 23:30 UTC** - First `polymarket-*` cluster (bot / trade / copy-trading / auto-trade / claude-code / ai-agent) published within a 30-second burst by a throwaway account (early SafeDep write-up: *Polymarket npm Packages Steal Crypto Wallet Keys*).
- **2026-06-19 → 2026-06-25** - `bn-lint`, `decimal-format-utils`, `ts-precision` published under sibling accounts.
- **2026-06-23 19:48 UTC** - `polymarket-stake-math` first version published by npm account `haha1999`; six versions in the following 12 hours, with the infostealer injected mid-sequence and delivery pivoting to Vercel-hosted C2 the next morning (Panther).
- **2026-06-29 05:44 UTC** - `clob-client-math` published (unpublished 2026-06-30 by npm-support).
- **2026-06-30** - Public issue `Trum3it/polymarket-arbitrage-bot#2` flags `clob-client-math` as malicious.
- **2026-07-17** - SafeDep publishes *The Polymarket Trap* consolidating the 30-package cluster; Panther publishes matching version-by-version teardown of `polymarket-stake-math`.

## Related tracked activity

A single-package impersonator with an overlapping author profile - `polymarket-clob-math@1.0.4`, tracked under `GHSA-3q5w-m6wr-5jp2` and published 2026-06-27 - is recorded separately as `npm-2026-06-27-polymarket-clob-math-vercel-loader` because its execution path (install-time Vercel JSON+tarball loader) differs from Polymarket Trap's postinstall dropper family.

## Impact

- Cloning the fake `Trum3it/polymarket-arbitrage-bot` repo and running `npm install` executes the infostealer - 53 forks each independently triggered the payload before takedown
- `.env` files with `POLYMARKET_PRIVATE_KEY` are on disk BEFORE `npm install` finishes (per the bot's setup instructions), so the infostealer reads the trading wallet's raw private key on the first install
- Second-stage infostealer walks crypto wallet vaults (MetaMask, Phantom, Solflare, OKX Wallet, Coinbase Wallet, TrustWallet, Backpack, TronLink); browser cookies + saved passwords (Chrome, Firefox, Brave); SSH private keys; AWS credentials; `.npmrc` and `.pypirc` tokens; Docker config; shell history (bash/zsh/fish/PowerShell); password manager databases (Bitwarden vault, KeePass `.kdbx`, 1Password `.1pux`)
- C2 URL is READ FROM THE PACKAGE'S `homepage` FIELD rather than hardcoded, defeating string-search / static IOC detection on the tarball
- 9 of the 10 npm accounts share a common `scripts/install-check.cjs` / `scripts/verify-peer.cjs` postinstall template - a same-family pattern lockfile scanners can match on the file name once one sample is known

## What to do

1. Grep every `package.json` and lockfile for any of the affected package names; if any of the 10 accounts are pinned, treat every host that ran `npm install` as fully compromised and rotate credentials from a separate clean device
2. If you cloned `Trum3it/polymarket-arbitrage-bot` (or any of Trum3it's other repos, including `polymarket-copy-trading-bot`): rotate the wallet whose `POLYMARKET_PRIVATE_KEY` was placed in `.env`, plus every credential accessible from that host - the infostealer sweeps AWS, npm, PyPI, Docker, SSH, and password-manager vaults in a single pass
3. Add a lint rule that flags dependencies declared in `package.json` but never `import`ed / `require`d in source - `clob-client-math` in the fake repo is present ONLY to trigger its postinstall hook
4. Enforce scoped-name policies for Polymarket integrations: the LEGITIMATE package is `@polymarket/clob-client` under the `@polymarket` scope; unscoped `clob-*` and `polymarket-*` names are red flags unless traced to an owned account
5. Block postinstall execution in CI where possible (`npm ci --ignore-scripts`) and audit `scripts/install-check.cjs` / `scripts/verify-peer.cjs` filenames across your Verdaccio / Nexus / Artifactory tarball cache

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [The Polymarket Trap: A Fake Arbitrage Bot, Ten npm Accounts, and Four Ways to Deliver an Infostealer](https://safedep.io/defi-infostealer-fake-arbitrage-bot-npm/) - SafeDep
- [A Patient Trojan Dropper: polymarket-stake-math Steals Wallet Keys, Browser Sessions, and Telegram from Crypto Developers](https://panther.com/blog/a-patient-trojan-dropper-polymarket-stake-math-steals-wallet-keys-browser-sessions-and-telegram-from-crypto-developers) - Panther
- [Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys](https://www.stepsecurity.io/blog/malicious-polymarket-bot-hides-in-hijacked-dev-protocol-github-org-and-steals-wallet-keys) - StepSecurity
- [Trum3it/polymarket-arbitrage-bot - the fake bait repo](https://github.com/Trum3it/polymarket-arbitrage-bot) - GitHub
- [@polymarket/clob-client - the LEGITIMATE Polymarket CLOB SDK](https://www.npmjs.com/package/@polymarket/clob-client) - npm
- [GHSA-x384-v7hw-q48x - polymarket-stake-maths (trailing-s sibling) malware advisory](https://github.com/advisories/GHSA-x384-v7hw-q48x) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-17-polymarket-trap-clob-client-math
Markdown version: https://dependencywatch.io/incident/npm-2026-07-17-polymarket-trap-clob-client-math.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).