polymarket-kelly-math-stake@3.6.2

Analysis

The postinstall hook in scripts/install-check.cjs fetches a remote JSON config from jipred[.]vercel[.]app, extracts a bundle URL from it, downloads a .tgz archive, extracts it into a .peer/ directory, runs npm install on the extracted content, and then requires and executes peer-math.js from the downloaded bundle. This is a multi-stage remote code execution payload that downloads and runs arbitrary code at install time. The package's index.js and kelly.js are benign decoy math functions; the malicious behaviour is entirely in the postinstall script.