The Polymarket Trojan: Verified GitHub Org Hijacked to Distribute Crypto-Stealing Bots

**Executive Summary:** StepSecurity discovered a supply-chain attack in which the verified GitHub organization dev-protocol was hijacked to host malicious Polymarket trading bot repositories; typosquatted npm packages (e.g., lint-builder, ts-bign, big-nunber) install an SSH backdoor and a file/private-key stealer that exfiltrates data to C2 domains such as cloudflareguard.vercel.app while the bots continue to function normally to evade detection.