If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (63a4eba33a56521a94e4e0b3ab2923d58b0c5cd398c791e36433536591a1d6ff)
Package name and description advertise a 'Polymarket API SDK', but the shipped code contains no Polymarket functionality. The exported getPlugin() helper fetches JSON from https://svganchordev.net/icons/106 and passes the response's `credits` field to a Function constructor invoked with require, module, process, Buffer, and related Node globals — giving the remote endpoint arbitrary code execution in the caller's Node.js process. The Polymarket branding and 'react/helper/svg' keywords are cover for a remote fetch-and-eval backdoor. The tarball also inadvertently ships an OpenSSH ed25519 private key (`gitlab`) belonging to the author, which does not harm the installer but should be rotated by the maintainer.