polymarket-stake-mathss

{"modified":"2026-08-10T12:45:51Z","published":"2026-08-10T12:45:51Z","schema_version":"1.7.4","id":"MAL-2026-13707","summary":"Malicious code in polymarket-stake-mathss (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ef71354e27f0e5798fee884366776d5b76ba0df0122148d1f4f7aeeef42b45cc)\nTyposquat of `polymarket-stake-math` (double `s`). The postinstall script (install-check.cjs) resolves a bundle URL from the package.json `homepage` field (`https://log-taker.store/config/stake-math-sync.json`), downloads a tarball via fetchToFile, extracts it with `tar -xzf`, runs `npm install` inside the extracted directory, then require()s `.peer/peer-math.js` and invokes `syncSession()`. The fetch is unpinned, unsigned, and points at an author-controlled domain unrelated to any Polymarket infrastructure. The install-time code path is wrapped in benign-sounding identifiers (resolvePeerBundleUrl, runPeerSync, extractPeerBundle, PSM_INSTALL_FAST) that imitate a legitimate peer-dependency check. Installing the package causes arbitrary attacker-controlled code from log-taker.store to execute on the installer's machine.\n","affected":[{"package":{"ecosystem":"npm","name":"polymarket-stake-mathss"},"versions":["3.5.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/install-check.cjs","sha256":"17bc8d92cdbf9fb042d3874e49b9682d4875bb4c950144485a1df32ad1d4a96e","tlsh":"01a1559519a2727346b1ebb8c722941eff2340233561c360f6de96952fb72a4c352dec"},{"path":"package.json","sha256":"a763f999f0a65ce586f5b2ad5d6decd79926fac060a18147fd61c3320155013e","tlsh":"ebf02837d9604d3724b99fad5e691644f4610b5f73a04d0b70bb500c4fb117315ab73a"}],"package_integrity":[{"filename":"polymarket-stake-mathss-3.5.2.tgz","hashes":{"sha1":"f9bf44b5e528f4562472f75185304bdd67fed87b","sha512_sri":"sha512-7N/s6AswID930cnMNbT38moVgWqosYLZnjLoqWeO8uwPuC6OaoLyzv+P02e3/Pdfom2+ay6zZNL3GmZoDUbfAQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/polymarket-stake-mathss/v/3.5.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017281","import_time":"2026-08-10T12:51:45.988422786Z","modified_time":"2026-08-10T12:45:51Z","sha256":"ef71354e27f0e5798fee884366776d5b76ba0df0122148d1f4f7aeeef42b45cc","source":"amazon-inspector","versions":["3.5.2"]}]}}