registry / kelly-sizing / 0.1.1

kelly-sizing@0.1.1

Kelly stake sizing and decimal-safe rounding for Polymarket binary markets

AI Security Review

scanned 2h ago · by lpm-firewall-ai

On npm install, the package fetches a configuration-controlled tarball, installs its dependencies, and executes code from it. This is unrelated to local Kelly-sizing helpers and allows remote code execution.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install postinstall

Impact

Remote operator can execute arbitrary code in the installing user's environment.

Mechanism

remote configuration selects a downloaded bundle that is installed and required

Attack narrative

Installing the package invokes scripts/install-check.cjs. It fetches the manifest homepage as JSON, accepts a bundle URL from its response, downloads and extracts that tarball under .peer, runs npm install there, then requires .peer/peer-math.js and calls syncSession(). The downloaded code is neither packaged nor integrity-pinned, so a remote endpoint controls install-time execution.

Rationale

This is an unconsented postinstall remote-code loader disguised as an install check. The packaged library itself is benign math, but its lifecycle hook creates a concrete execution chain.

Evidence

package.jsonscripts/install-check.cjsindex.jskelly.js.peer.peer/peer-math.js

Network endpoints1

pm-trading-dev-tools-be.vercel.app/config/clob-math.json

kelly-sizing@0.1.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code