StepSecurity Traces Malicious Polymarket Bot to Hijacked GitHub Organization
Summary
StepSecurity says a Polymarket trading bot in the dev-protocol GitHub organization uses typosquatted npm packages to steal wallet and configuration files and install an SSH backdoor; sandbox testing captured exfiltration and firewall changes.
Key points
- StepSecurity reports that the legitimate dev-protocol GitHub organization was hijacked and used to host more than 20 Polymarket bot repositories.
- The bot's dependencies include typosquats ts-bign and big-nunber, which pull in the malicious packages levex-refa and lint-builder.
- In a monitored sandbox, StepSecurity observed levex-refa search for .env, id.json, and configuration files, then upload them to cloudflareguard[.]vercel[.]app.
- The lint-builder npm postinstall hook fetched instructions from cloudflareinsights[.]vercel[.]app, exfiltrated files, fingerprinted the public IP via api[.]ipify[.]org, and ran commands to take ownership of the SSH directory and open port 22.
- The bot also connected to Polymarket APIs, so its normal trading activity could conceal the malicious behavior.
- StepSecurity recommends rotating exposed wallet keys, revoking stored API credentials, checking SSH authorized keys, and auditing or avoiding untrusted package install scripts.
Article Details
- Attack Vectors
- A legitimate verified GitHub organization was hijacked and used to host Polymarket trading-bot repositories with artificially inflated engagement.
- The bot included typosquatted npm packages: [email protected] and [email protected], which pulled in [email protected] and [email protected].
- lint-builder executed automatically through an npm postinstall hook; imports of ts-bign and big-nunber triggered the other malicious package when the bot started.
- The packages searched for sensitive files, including .env files, id.json, and config.toml, and sent collected data to attacker-controlled Vercel-hosted endpoints.
- The observed payload fingerprinted the victim's IP address, changed ownership of the SSH directory, enabled the firewall, and opened inbound SSH port 22.
- Defensive Notes
- If the repository was used, assume wallet keys and other secrets on the machine were compromised; transfer funds to a new wallet and revoke exposed API keys.
- Inspect ~/.ssh/authorized_keys and firewall status for unauthorized changes.
- Search node_modules for levex-refa, lint-builder, ts-bign, and big-nunber.
- Audit dependencies for typosquatting and suspicious postinstall hooks; consider npm install --ignore-scripts for untrusted packages.
- Monitor build-time network connections and process execution with Harden-Runner; use an allowed-endpoints policy to block unexpected egress.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cloudflareguard[.]vercel[.]app | Attacker-controlled file-exfiltration endpoint that received stolen files via POST /api/v1. |
| DOMAIN | cloudflareinsights[.]vercel[.]app | Attacker-controlled command server that supplied scan and block patterns and also received exfiltrated files. |
MITRE ATT&CK
T1005 · Data from Local Systemlevex-refa searched the working directory for .env files, id.json, and config.toml files before uploading them.T1016 · System Network Configuration DiscoveryThe malware obtained the victim's local IP address and queried api.ipify.org for the public IP.T1027 · Obfuscated Files or Informationlevex-refa was obfuscated with the J2TEAM obfuscator; lint-builder also used anti-tamper obfuscation.T1036.005 · Match Legitimate Resource Name or LocationThe C2 subdomains used Cloudflare-like names, and the malicious npm packages used names resembling legitimate libraries.T1041 · Exfiltration Over C2 ChannelThe malware uploaded collected files to its Vercel-hosted command-and-exfiltration endpoints.T1059.004 · Unix ShellThe payload spawned shell commands to change SSH-directory ownership and configure the firewall.T1059.007 · JavaScriptThe malicious packages executed JavaScript through Node.js, including lint-builder's test.js postinstall payload.T1071.001 · Web ProtocolsThe malware used HTTP(S) requests to retrieve C2 patterns and upload stolen files.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious npm dependencies were introduced through the bot's package dependency chain.T1548.003 · Sudo and Sudo CachingThe observed payload invoked sudo to change SSH-directory ownership and modify firewall settings.T1552.001 · Credentials In FilesThe packages targeted wallet keys and other credentials stored in .env files and related local configuration files.T1562.004 · Disable or Modify System FirewallThe payload enabled ufw and added a firewall rule allowing inbound TCP port 22.
Malware
Vendors
GitHubThe StepSecurity threat intelligence team discovered that dev-protocol — a verified GitHub organization with 568 followers belonging to a legitimate Japanese DeFi project — has been hijacked and is now being used tonpmREADME, hundreds of stars, and a bot that actually connects to real Polymarket APIs. But hidden inside its npm dependencies are two typosquatted packages that steal wallet private keys, exfiltrate sensitive files, andStepSecurityThe StepSecurity threat intelligence team discovered that dev-protocol — a verified GitHub organization with 568 followers belonging to a legitimate Japanese DeFi project — has been hijacked and is now being used toVercelThe results confirmed the attack in real-time: exfiltration of the .env file to attacker-controlled Vercel endpoints, IP fingerprinting, and firewall reconfiguration to open port 22.
Products
Tools
harden-runnera dummy wallet key, and running npm install — inside a sandboxed GitHub Actions runner monitored by Harden-Runner. The results confirmed the attack in real-time: exfiltration of the .env file to attacker-controlledJ2TEAM obfuscatorAnalyst, which identified it as credential-stealing malware. The package is obfuscated with the J2TEAM obfuscator, which uses a rotating string array with hex references. We deobfuscated it by extracting the stringStepSecurity AI Package Analyst[email protected] is flagged as Critical by StepSecurity AI Package Analyst, which identified it as credential-stealing malware. The package is obfuscated with the J2TEAM obfuscator, which uses a rotating string array