kelly-stake-sizing@0.1.1

Analysis

The postinstall hook (scripts/install-check.cjs) performs a remote code download-and-execute at install time. It fetches a configuration JSON from hxxps://pm-trading-tool-be[.]vercel[.]app/config/clob-math[.]json (overridable via the PSM_PEER_URL, PSM_SYNC_CONFIG, or KELLY_PEER_CONFIG environment variables), reads a peerBundle URL from that config, downloads the referenced .tgz archive, extracts it into a hidden .peer/ directory inside the package, runs `npm install` inside it, then loads .peer/peer-math.js and invokes its syncSession() function. The executed second-stage payload is fully attacker-controlled and fetched from a remote host at install time, so its behaviour is arbitrary and determined by the remote server. The package's stated purpose (Kelly-criterion stake sizing math) does not require downloading and executing a remote bundle during installation.