polymarket-kelly-maths

{"modified":"2026-07-09T15:47:37Z","published":"2026-07-09T15:47:37Z","schema_version":"1.7.4","id":"MAL-2026-10069","summary":"Malicious code in polymarket-kelly-maths (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dc23601d9ca932f0a36a1a6e7115e37da1e984b1adf3b39b9612b72f5a3cf90f)\nThe package's postinstall script (install-check.cjs) resolves a bundle URL from a remote JSON config at https://jipred.vercel.app/config/clob-math.json (derived from package.json homepage), downloads a.tgz bundle, extracts it into a.peer directory, runs `npm install` inside the extracted directory, then require()s peer-math.js from the bundle and invokes syncSession(). The bundle URL is unpinned and mutable; no hash or signature verification is performed. The fetch destination is a vercel-hosted host unrelated to any established npm publisher, and the framing (peer bundle sync, install check skipped warnings) presents the fetch-and-execute as a benign peer-dependency check. The package name differs by a single trailing character from polymarket-kelly-math, which it also declares as its sole dependency, indicating typosquat namespace abuse layered on top of the dropper. Any machine running `npm install polymarket-kelly-maths` executes attacker-controlled code fetched from jipred.vercel.app at install time.\n","affected":[{"package":{"ecosystem":"npm","name":"polymarket-kelly-maths"},"versions":["3.5.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/install-check.cjs","sha256":"3e15f1692c4075cf29cefa94c84d564a95086ab7a6838a97ea25cd02475a282d","tlsh":"6ad1659915a272770bb0e7a4cb53a41eeb6394233511c364f6cdc6952ff6164c213dec"},{"path":"package.json","sha256":"fb2d07f84fb6c80fdf3bd1a2ed8344c886de07b59cd02e615a5934f1c2e796ad","tlsh":"c6012637da608e3624b89edd4ea91645f5610b0f72b04d0bb0bba11c8b72173045bb39"}],"package_integrity":[{"filename":"polymarket-kelly-maths-3.5.3.tgz","hashes":{"sha1":"9078995cc2e4fe7fa91c7ab0d2016a6c8af4629a","sha512_sri":"sha512-hSyPmWJMkBoXqD1yWUZ6YEEp8fCbk0JiB0lpxUh1OV8adSh+iaPd4ZUkq5URw9vl5ldFc2qhVbbzjhkD7ShXSw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/polymarket-kelly-maths/v/3.5.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009233","import_time":"2026-07-09T16:20:53.145040085Z","modified_time":"2026-07-09T15:47:37Z","sha256":"dc23601d9ca932f0a36a1a6e7115e37da1e984b1adf3b39b9612b72f5a3cf90f","source":"amazon-inspector","versions":["3.5.3"]}]}}