polymarket-kelly-stake-math@3.6.1
Malicious code in polymarket-kelly-stake-math (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1105 · Ingress Tool Transfer
Analysis
The postinstall hook (scripts/install-check.cjs) fetches a configuration from hxxps://jipred[.]vercel[.]app/config/clob-math[.]json, resolves a bundle URL from that config, downloads a .tgz archive, extracts it into a .peer/ directory, runs npm install inside it, and then requires peer-math.js and calls syncSession(). This allows the publisher to serve arbitrary code at install time by changing the remote config. The bundled kelly.js math library is benign; the malicious behaviour is entirely in the postinstall hook.
- analyzed by
- Leitwacht
- first seen
- Jul 9, 2026, 09:03 AM
- analyzed
- Jul 9, 2026, 09:04 AM
Related advisories
- polymarket-kit@2.4.1
- chai-as-const@1.4.5
- uncaxss@1.3.4
- no-for-of-loops@1.0.1
- express-route-engine@3.6.6
- mchain-sdk@4.2.5
- @grab-food/order-sdk-web@1.0.1
- testudo-pack@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.