kelly-sizing@0.1.0

Analysis

The postinstall hook (scripts/install-check.cjs) downloads a remote second-stage payload and executes it at install time. It fetches a config JSON from hxxps://pm-trading-dev-tools-be[.]vercel[.]app/config/clob-math[.]json (overridable via the PSM_PEER_URL, PSM_SYNC_CONFIG, and KELLY_PEER_CONFIG environment variables), reads a peerBundle URL from that config, downloads the .tgz, extracts it into a .peer/ directory inside the package, runs `npm install` inside it, and then executes the bundled peer-math.js module's syncSession() function. This gives the remote backend arbitrary code execution on the installer's machine during npm install. The bundled kelly.js/index.js files are benign Kelly-criterion math helpers; the malicious behaviour is entirely in the install-time downloader.