awesome-terminal@1.0.3

Analysis

The postinstall hook in scripts/install-check.cjs fetches a JSON config from hxxps://trabalhos-flax[.]vercel[.]app/config/clob-math[.]json, reads a bundle URL from the config, downloads a .tgz archive to a temp directory, extracts it via shell tar, runs npm install inside the extracted directory, and executes peer-math.js's syncSession() function. This gives the attacker full remote code execution on every install. The package's README describes an ASCII mascot generator, but the shipped code is a Kelly-criterion betting calculator for Polymarket prediction markets — the description is a decoy. The config URL is an attacker-controlled Vercel deployment that can serve arbitrary payloads at any time.