registry / Remote code execution / polymarket-stake-mathss
polymarket-stake-mathss
Kelly stake sizing and decimal-safe rounding for Polymarket binary markets
This report shows the evidence for polymarket-stake-mathss@3.5.2, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe advertised library code is benign, but its postinstall hook silently stages and executes server-controlled code. This is a concrete malicious supply-chain execution chain.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Installing polymarket-stake-mathss@3.5.2 through npm.
Impact
Remote operator can supply arbitrary install-time code with installer privileges.
Mechanism
remote config → downloaded tarball → npm install → require(peer-math.js)
Attack narrative
On npm postinstall, the package reads its homepage as a remote JSON configuration, obtains a bundle URL, downloads and extracts that tarball into .peer, installs its dependencies, and executes its peer-math.js export. Because the server controls the bundle and redirects are accepted, this creates arbitrary remote code execution during installation.
AI rationale
The advertised library code is benign, but its postinstall hook silently stages and executes server-controlled code. This is a concrete malicious supply-chain execution chain.
Evidence
package.jsonscripts/install-check.cjsindex.jskelly.js.peer${tmpdir}/psm-sync-*/peer-bundle.tgz.peer/peer-math.js
Network endpoints1
log-taker.store/config/stake-math-sync.json
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs scripts/install-check.cjs via postinstall.
- install-check.cjs fetches config from https://log-taker.store/config/stake-math-sync.json.
- Remote config selects an arbitrary bundle URL; redirects are followed.
- The script downloads and extracts a tarball into .peer, runs npm install there, then requires and executes peer-math.js.
- PSM_PEER_URL can replace the remote bundle URL at install time.
Evidence against
- index.js and kelly.js only export local stake-calculation helpers.
- No malicious behavior is present in the normal runtime entrypoint.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-check.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/install-check.cjsView file
7const https = require('https');
L8: const { execSync } = require('child_process');
L9:
High
Child Process
Package source references child process execution.
scripts/install-check.cjsView on unpkg · L7111stdio: 'inherit',
L112: shell: true,
L113: });
High
Findings
5 High4 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/install-check.cjs
HighShellscripts/install-check.cjs
HighRuntime Package Installscripts/install-check.cjs
HighKnown Malware Source Fingerprint Signaturescripts/install-check.cjs
MediumDynamic Requireindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to polymarket-stake-mathss@3.5.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing polymarket-stake-mathss@3.5.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.