polymarket-stake-kelly-math@3.8.2

Analysis

On install, the postinstall hook (scripts/install-check.cjs) fetches a JSON config from hxxps://jipred[.]vercel[.]app/config/clob-math[.]json, reads a peerBundle URL from that config, downloads a .tgz archive from that URL, extracts it into a .peer/ directory inside the package, runs npm install inside .peer/, then requires peer-math.js and calls its syncSession() function. This is a multi-stage remote code execution pipeline: the attacker controls the config endpoint and can serve arbitrary second-stage payloads at install time. The package is a combosquat of the legitimate polymarket-stake-math package (the README references the wrong package name).