Malware-Slop: Crypto Stealer Impersonating Polymarket Exposes Its Own Credentials

polymarket-kit: npm Supply Chain Attack Combines Cloud Harvesting and a W

Then Exposes Its Own GitLab Credentials

Overview

The OX Research team recently discovered a malicious npm package

cryptocurrency theft and credential exfiltration campaign. The package specifically impersonates target high-value crypto users. In a new demonstration of sloppy malware – the threat actor left their own GitLab private SSH keys exposed in cleartext within the public package.

The malware also acts as a Remote Access Trojan…