Critical Malicious Code Vulnerability in polymarket-clob Package
Summary
MAL-2026-77: Malicious code in polymarket-clob (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The polymarket-clob package is an npm library designed for managing and interacting with the Polymarket platform. It facilitates the creation and management of prediction markets. However, this package has been identified to contain malicious code that compromises the security of any system it is installed on, potentially leading to unauthorized access and data breaches.
Vulnerability Detail
The vulnerability originates from embedded malicious code within the polymarket-clob package. This code can fully compromise any computer that has the package installed or running, allowing attackers to gain control over the system. As a result, all secrets and keys stored on the affected computer should be considered compromised. The malicious nature of this code is classified under CWE-506, which indicates that the product contains code that appears to be malicious in nature.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall polymarket-clobIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, it is recommended to rotate all secrets and keys stored on the affected computer from a different, secure machine. Additionally, ensure that any other potentially compromised software is also reviewed and secured.
Conclusion
The polymarket-clob package contains malicious code that poses a significant security risk. Immediate action is required to remove the package and secure any compromised systems. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for polymarket-clob →
FAQ
The polymarket-clob package is an npm library used for managing prediction markets on the Polymarket platform.
The malicious code can fully compromise your system, allowing unauthorized access to sensitive data and control over your computer.
You should remove the polymarket-clob package immediately and rotate any secrets or keys stored on the affected system.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While removing the package is essential, there is no guarantee that all malicious software will be removed. It is advisable to take additional security measures.
