ACCORDING to StepSecurity, the dev-protocol GitHub organisation—described as a verified project with 568 followers—was hijacked in February 2026 and is now used to distribute malicious Polymarket trading bots. The malicious repo, polymarket-copytrading-bot-sport, includes two typosquatted npm packages that steal wallet private keys and exfiltrate sensitive files, with the attack demonstrated by running npm install in a sandboxed GitHub Actions runner monitored by Harden-Runner.
The campaign involved two Vercel-hosted endpoints impersonating Cloudflare services: cloudflareguard.vercel[.]app for exfiltration and cloudflareinsights.vercel[.]app as a C2 server, both observed during the attack, alongside IP fingerprinting via api.ipify[.]org. Notably, the report highlights that commits in the hijacked organisation were made by insionCEO, and that February 26, 2026 marked the onset of a flood of Polymarket scam repos within the organisation.
The two-stage attack included a postinstall payload that enables an SSH backdoor and opens port 22, allowing potential direct access to compromised machines, while the bot itself connects to real Polymarket APIs. If users ran the repository, they are urged to rotate wallet keys, check for unauthorized SSH keys, revoke API keys, and scan for the malicious packages levex-refa, lint-builder, ts-bign, and big-nunber.