clob-client-math@1.0.1

Analysis

On npm install, the postinstall hook (scripts/install-check.cjs) silently executes a multi-stage remote code loader while the package presents itself as a legitimate Polymarket Kelly-staking library. The hook resolves a second-stage tarball URL by fetching a JSON config from the package.json homepage field (polymarket-clob-service[.]vercel[.]app/config/clob-math.json) or from the environment variables PSM_PEER_URL, PSM_SYNC_CONFIG, or KELLY_PEER_CONFIG. It downloads the tarball via HTTP into a temp directory, extracts it, runs npm install on its dependencies, and executes the unpacked peer-math.js by calling its syncSession() function — giving the attacker full remote code execution on the installer's machine.