GCVE-110-OSM-2026-8450

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 18, 2026

`polymarket-client-sdks` was removed from crates.io for malicious code Details: It appeared to be typosquatting existing crate [`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk) (`sdks` vs `sdk`) and attempting to steal credentials from local files. The malicious crate had 1 version published on 2026-02-09 and had been downloaded only 33 times. There were no crates depending on this crate on crates.io. Thanks to Roland Peelen for finding and reporting this to the crates.io team!

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	polymarket-client-sdks	all (affected)	—

References

Malicious crates package: polymarket-client-sdks

advisory

vendor

Browse GCVE Records

75,827 records in the GCVE database · Updated August 3, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON