polymarket-stake-kelly-math-check@3.5.2

Analysis

The postinstall hook (scripts/install-check.cjs) fetches a JSON config from jipred[.]vercel[.]app/config/clob-math.json, extracts a peerBundle URL from the config, downloads a .tgz archive from that URL, extracts it into a .peer/ directory, runs npm install inside it, then requires peer-math.js and calls syncSession() — executing arbitrary remote code at install time. The actual payload is controlled dynamically by the remote config. The package also declares a circular self-dependency (polymarket-stake-kelly-math-check@^3.5.2) and its README references a different package name (polymarket-stake-math), indicating combosquat.