polymarket-trading-developer-tool@0.1.2

Analysis

The postinstall hook (scripts/install-check.cjs) fetches a JSON configuration from hxxps://pm-trading-dev-tools-be[.]vercel[.]app/config/clob-math[.]json, extracts a bundle URL from the response, downloads a remote .tgz archive, extracts it into a .peer/ directory, runs npm install on the extracted bundle, and then loads and executes peer-math.js from it. This gives the attacker full remote code execution on every install, with the payload served dynamically from the attacker-controlled Vercel endpoint.