polymarket-math-stake-kelly

{"modified":"2026-07-13T17:38:18Z","published":"2026-07-13T17:38:18Z","schema_version":"1.7.4","id":"MAL-2026-10466","summary":"Malicious code in polymarket-math-stake-kelly (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (408b5fd87b4b328671330e1ddb9333eb5d68d9a873f30237bd886a7632f038b5)\npolymarket-math-stake-kelly@3.7.2 runs scripts/install-check.cjs as a postinstall hook. The script reads a config URL (defaulting to https://jipred.vercel.app/config/clob-math.json), downloads a.tgz bundle referenced by that config to a local.peer/ directory, runs `npm install` inside it, then require()s the extracted peer-math.js and invokes syncSession(). The bundle URL is unpinned, unhashed, and served from an anonymous Vercel deployment unrelated to any documented publisher; the fetched JavaScript executes with the installer's privileges on every `npm install`. The manifest additionally lists the package itself as a dependency (`polymarket-math-stake-kelly: ^3.7.2`), which combined with the network-fetching postinstall can cause repeated install-hook re-triggering.\n","affected":[{"package":{"ecosystem":"npm","name":"polymarket-math-stake-kelly"},"versions":["3.7.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/install-check.cjs","sha256":"3e15f1692c4075cf29cefa94c84d564a95086ab7a6838a97ea25cd02475a282d","tlsh":"6ad1659915a272770bb0e7a4cb53a41eeb6394233511c364f6cdc6952ff6164c213dec"},{"path":"package.json","sha256":"d3c6e162af751181e13108bead7edc2810c3b7f93cad2a792bccf102e1c3b825","tlsh":"d701423bda608e3668b98f9d5e6a2644b4600b0ba2b04d0b70fba10c4f72173045ab79"}],"package_integrity":[{"filename":"polymarket-math-stake-kelly-3.7.2.tgz","hashes":{"sha1":"1b0398a19b748f21c33d7e7defec2c537e230e44","sha512_sri":"sha512-6lOvsL7NvqGnw2axXcYN0QwWnpHX5sHCAaU1XEfQdsShaPIR7xuOIHaR8vwQLHPSkRWOMo+x8kues6xBntiRiQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/polymarket-math-stake-kelly/v/3.7.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010275","import_time":"2026-07-13T18:10:12.779196889Z","modified_time":"2026-07-13T17:38:18Z","sha256":"408b5fd87b4b328671330e1ddb9333eb5d68d9a873f30237bd886a7632f038b5","source":"amazon-inspector","versions":["3.7.2"]}]}}