Polymarket Arbitrage Bot on GitHub Was Actually North Korean Malware

Published by James Harris on July 1, 2026July 1, 2026

On July 1, 2026, security firm SlowMist flagged a fake Polymarket arbitrage bot on GitHub that had already been downloaded by at least 53 developers before anyone caught it. The bot promised over $80,000 in annual profits, collected 36 stars and 53 forks, and delivered malware the moment someone ran “npm install.”

The lure was credible because the underlying premise is real. Legitimate bots have genuinely extracted extraordinary returns from Polymarket: one turned $313 into $414,000 in a single month, and another generated $2.2 million over two months, both documented by named researchers. That track record gave the fake bot cover, and the attackers knew it. The setup followed a now-familiar supply chain attack pattern: 30 malicious npm packages spread across multiple fresh accounts, all pointing to one repository. The malware itself was buried inside a dependency called “clob-client-math,” which was listed in the package.json but never actually imported anywhere in the bot’s source code, a tell that would only be visible to someone auditing the dependency tree rather than just running the installer. Security researchers attribute the campaign to North Korean actors running a broader operation called “Contagious Trader,” targeting crypto developers specifically. In March, hackers hijacked an Axios developer’s npm account to push malicious packages; in May, one compromised account was used to take over 323 packages in under 30 minutes.

The instruction to paste a Polymarket private key into a .env file before installation was not a bug in the attack design. It was the point.

Once installed, the malware swept MetaMask, Phantom, Coinbase Wallet, TrustWallet, browser-saved passwords from Chrome, Firefox, and Brave, SSH keys, AWS credentials, npm and PyPI tokens, and data from password managers including Bitwarden, KeePass, and 1Password. That is not a smash-and-grab on one wallet. It is a full-environment compromise, the kind that gives an attacker persistent access across cloud infrastructure, developer pipelines, and any downstream projects the victim touches. This attack lands in a context where Polymarket users were already on edge: a separate phishing campaign in late June drained $2.94 million from at least 11 accounts. Two distinct attack vectors in under two weeks on the same platform suggests coordinated attention, not coincidence.

SafeDep’s guidance is unambiguous: any machine that ran the installer should be treated as fully compromised. Rotate all wallet keys, replace every browser-stored password, cycle AWS credentials, SSH keys, and API tokens. For developers auditing exposure, the simplest check is looking for packages listed in package.json that never appear anywhere in the actual source code.