Live Wave Icon New Blog: Mini Shai-Hulud "Miasma" Hits @redhat-cloud-services: 32 Packages at Risk
•
Edit Calendar Icon 1 Jun 2026
SafeDep Logo
Pricing
Discover & Monitor
SCA & SBOM
SCA & SBOM

Scan dependencies, generate SBOMs, enforce policy.

AI Agent Discovery
AI Agent Discovery

See every AI tool and SDK in your org.

AI Agent Monitoring
AI Agent Monitoring

Audit every action your AI agents take.

Protect
Developer Security
Developer Security

Block malicious packages at install-time.

CI/CD Security
CI/CD Security

Block malicious packages in your pipeline.

MCP Server
MCP Server

Block threats inside your AI coding agent.

Agent API
Agent API

Threat intelligence API for custom agents.

Threat Intelligence
Threat Intelligence

Real-time malicious package verdicts.

Govern
Endpoint Protection
Endpoint Protection

Package events & AI inventory in the cloud.

Platform
Platform

Centralized policies, dashboard, compliance.

Vet
Vet

Scan and govern your dependencies across every PR and build.

PMG
PMG

Block malicious packages at install-time, before they enter your codebase.

xbom
xbom

Generate AI-enriched BOMs using real code evidence, not just manifests.

GRYPH
GRYPH

Monitor every AI coding agent action across your projects and workflows.

How it works Blog
Documentation
SDK
API
Threat Intelligence Hub
Login Start for Free GitHub 1.5k Discord
campaigns crypto-wallet-drainers

Crypto Wallet Drainers

discovered 2026-04-29
JSON CSV

npm packages using Polymarket and DeFi trading lures to steal cryptocurrency wallet private keys and drain victim funds.

Objective

Steal cryptocurrency wallet keys and drain victim funds.

Packages

  • npm redeem-onchain-sdkattributed-to
  • npm polymarket-trading-cliattributed-to
  • npm polymarket-terminalattributed-to
  • npm polymarket-tradeattributed-to
  • npm polymarket-auto-tradeattributed-to
  • npm polymarket-copy-tradingattributed-to
  • npm polymarket-botattributed-to
  • npm polymarket-claude-codeattributed-to
  • npm polymarket-ai-agentattributed-to
  • npm polymarket-traderattributed-to

Indicators

  • ipv4 18.208.244.120communicates-with
  • md5 0123456789abcdef0123456789abcdefindicates
  • domain polymarketbot.polymarketdev.workers.devcommunicates-with
  • sha256 e01b85c1437085a519217338fe4ee5ed7858c28a10f8c1477b2f1857c3386edbindicates
  • email dmtnatpepes@proton.meexfiltrates-to

Techniques

  • ttp T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Toolsuses
  • ttp T1059.007 Command and Scripting Interpreter: JavaScriptuses
  • ttp T1041 Exfiltration Over C2 Channeluses
  • ttp T1552.004 Unsecured Credentials: Private Keysuses
  • ttp T1552.001 Unsecured Credentials: Credentials In Filesuses
  • ttp T1071.001 Application Layer Protocol: Web Protocolsuses
  • ttp T1102 Web Serviceuses
  • ttp T1546 Event Triggered Executionuses
Read the full analysis →
SafeDep Logo
SafeDep
Terms · Privacy Policy
SOC 2 Type II Certified
ISO 27001:2013 Certified
SOC 2 Type II Certified
ISO 27001:2013 Certified
SOC 2 Type II Certified
ISO 27001:2013 Certified
Product
  • Features
  • Pricing
  • How it works
Solutions
  • AI Agent Discovery
  • AI Agent Monitoring
  • Threat Intel for Agents
  • Threat Intel for SecOps
  • MCP Server
  • Endpoint Protection
  • Threat Intel Data Hub
  • Developer API
  • Partners
Support
  • Docs
  • Community Forum
  • FAQ
  • Professional Services
  • Status
Company
  • About
  • Blog
  • Contact
  • Careers
  • GitHub
© 2026 SafeDep, Inc. All rights reserved