polymarket/rs-clob-client · Security
`polymarket-clients-sdk` was removed from crates.io for malicious code
- GHSA ID
- GHSA-382q-fpqh-29f7
- Severity
- critical
- Published
- Updated
Description
It appeared to be typosquatting existing crate polymarket-client-sdk (clients vs client) and attempting to steal credentials from local files.
The malicious crate had 6 versions published on 2026-02-05 and had been downloaded only 59 times. There were no crates depending on this crate on crates.io.
Polymarket thanks Socket.dev for detecting and reporting this to the crates.io team!