Polymarket SDK typosquats on crates.io

What happened

Between February 5 and 19, 2026, three crates impersonating the real Polymarket Rust SDK were published to crates.io: polymarket-clients-sdk (extra "s" before the dash), polymarket-client-sdks (extra "s" at the end), and polymarkets-client-sdk (extra "s" on the first segment). All three lifted documentation from the legitimate package to look credible at install time.

On run, each crate walks the local filesystem for credential files — .aws/credentials, .npmrc, id_rsa, environment files — and posts them to attacker infrastructure. RustSec yanked the crates and disabled the publishing accounts. Combined downloads stayed under 100 across all three, so the absolute exposure is small, but the targeting is deliberate: only Polymarket / Web3 developers would search for that exact package name.

The broader pattern — typosquats of niche, high-value ecosystem clients — is now common enough on crates.io that any project resolving Web3 SDK dependencies should pin to known-good versions and run cargo-audit against the RustSec advisory database in CI.

Affected packages (3)

Impact

• Targeted Polymarket/Web3 developers via deliberate typosquats
• Local credential-file theft from build/dev systems
• Low total downloads but high-value targets

What to do

1. 1Audit Cargo.toml + Cargo.lock for the typosquatted names
2. 2Rotate credentials present on any host that built with these crates
3. 3Run cargo-audit against the RustSec advisory DB in CI

References

• RustSec: RUSTSEC-2026-0010

  rustsec.org
  RustSec