polymarket-stake-mathss@3.5.2

Analysis

The postinstall hook (scripts/install-check.cjs) downloads and executes a second-stage bundle at install time. It fetches a config from hxxps://log-taker[.]store/config/stake-math-sync[.]json (or the PSM_SYNC_CONFIG / KELLY_PEER_CONFIG env vars), reads a peerBundle URL from it, downloads that .tgz archive, extracts it with a shell `tar -xzf` into a .peer directory, runs `npm install` inside it, then loads .peer/peer-math.js and invokes its syncSession() function. The package's own kelly.js/index.js are a benign Kelly-stake calculator, but installing the package runs arbitrary remote code fetched from the attacker-controlled log-taker[.]store host.