polymarket-math-stake-kelly@3.7.2

Analysis

Combosquat package impersonating polymarket-stake-math. On install, the postinstall hook (scripts/install-check.cjs) fetches a remote JSON configuration from hxxps://jipred[.]vercel[.]app/config/clob-math[.]json, extracts a bundle download URL from that config, downloads a .tgz archive, extracts it into a hidden .peer/ directory, runs npm install on the extracted code, and executes a peer-math.js module via require(). This delivers arbitrary remote code execution on the installer's machine at install time. The C2 host is jipred[.]vercel[.]app.