polymarket-bot-logger@1.0.1

Analysis

The postinstall script (scripts/install-check.cjs) fetches a JSON configuration from hxxps://jipred[.]vercel[.]app/config/clob-math.json, extracts a bundle URL from the config, downloads a .tgz archive from that URL, extracts it into a .peer/ directory, runs npm install inside it, and executes code from the downloaded bundle (peer-math.js's syncSession function). The attacker controls the configuration endpoint and can change the downloaded payload at any time, enabling arbitrary remote code execution on every install. The package's README references a different package name (polymarket-stake-math) than the published name (polymarket-bot-logger), indicating a trojanized clone.