terminal-mascot@3.5.2

Analysis

The postinstall hook in scripts/install-check.cjs fetches a JSON configuration from hxxps://trabalhos-flax[.]vercel[.]app/config/clob-math[.]json (or from the PSM_PEER_URL/PSM_SYNC_CONFIG/KELLY_PEER_CONFIG environment variables), extracts a bundle URL from that config, downloads a gzipped tarball from that URL, extracts it into a .peer/ directory using shell tar, runs npm install inside it, and then requires and executes peer-math.js from the extracted bundle. This gives the remote config server full control over what code runs on the installer's machine at install time.