marked-prettier@1.0.5

Analysis

marked-prettier is a trojanized clone of a legitimate-looking ANSI terminal helper library. The package name combines two popular packages (marked + prettier) as a combosquat. On install, the postinstall script (scripts/install-check.cjs) fetches a configuration JSON from hxxps://trabalhos-flax[.]vercel[.]app/config/clob-math[.]json, reads a bundle URL from the response, downloads a gzip tarball from that URL, extracts it using shell tar, runs npm install inside the extracted directory, then requires a file called peer-math.js and calls its syncSession() function — enabling arbitrary remote code execution on the installer's machine. The C2 infrastructure is hosted on Vercel (trabalhos-flax[.]vercel[.]app). The package's advertised functionality (ANSI helpers, Kelly criterion staking math) is a decoy; the shipped source code is minimal and the postinstall hook is the real payload.