ts-poly-utls@1.2.4

Analysis

The postinstall hook in scripts/install-check.cjs downloads a tarball from a remote URL (resolved at runtime from the package.json homepage field hxxps://polymarket-clob-service[.]vercel[.]app/config/clob-math[.]json or the PSM_PEER_URL/PSM_SYNC_CONFIG/KELLY_PEER_CONFIG environment variables), extracts it with tar into a .peer/ directory, runs npm install on the extracted bundle, and then loads and executes code from it via require(). The package name ts-poly-utls is a combosquat of a Polymarket-related package name; the shipped kelly.js and index.js are trivial decoy math functions. The real payload is fetched and executed at install time from an attacker-controlled endpoint.