OpenSSF/OSV advisory MAL-2026-14432 confirms this npm version as malicious. kelly-stake-sizing@0.1.1 declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from https://pm-trading-tool-be.vercel.app/config/clob-math.json, resolves a bundle URL from it, downloads a.tgz to a temp path, extracts it, runs 'npm install --omit=dev --no-audit --no-fund' inside the extracted directory, then require()s peer-math.js from the extracted bundle and invokes...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in kelly-stake-sizing (npm)
Details
kelly-stake-sizing@0.1.1 declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from https://pm-trading-tool-be.vercel.app/config/clob-math.json, resolves a bundle URL from it, downloads a.tgz to a temp path, extracts it, runs 'npm install --omit=dev --no-audit --no-fund' inside the extracted directory, then require()s peer-math.js from the extracted bundle and invokes syncSession(). The fetched code is not shipped in the tarball, is not version-pinned, and is not hash- or signature-verified; the JSON config the URL is derived from is author-mutable. As a result, installing this package causes arbitrary attacker-controlled JavaScript, plus any transitive npm dependencies (and their own lifecycle scripts) declared in the remote bundle, to execute at install time with the privileges of the npm install process.
Decision reason
OpenSSF Malicious Packages via OSV confirms kelly-stake-sizing@0.1.1 as malicious (MAL-2026-14432): Malicious code in kelly-stake-sizing (npm)