registry / polymarket-stake-mathss / 3.5.2

polymarket-stake-mathss@3.5.2

Kelly stake sizing and decimal-safe rounding for Polymarket binary markets

AI Security Review

scanned 5d ago · by lpm-firewall-ai

npm postinstall retrieves a remotely selected bundle and executes code from it. This is an unconsented remote-code execution chain unrelated to the advertised math helpers.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing polymarket-stake-mathss@3.5.2 through npm.

Impact

Remote operator can supply arbitrary install-time code with installer privileges.

Mechanism

remote config → downloaded tarball → npm install → require(peer-math.js)

Attack narrative

On npm postinstall, the package reads its homepage as a remote JSON configuration, obtains a bundle URL, downloads and extracts that tarball into .peer, installs its dependencies, and executes its peer-math.js export. Because the server controls the bundle and redirects are accepted, this creates arbitrary remote code execution during installation.

Rationale

The advertised library code is benign, but its postinstall hook silently stages and executes server-controlled code. This is a concrete malicious supply-chain execution chain.

Evidence

package.jsonscripts/install-check.cjsindex.jskelly.js.peer${tmpdir}/psm-sync-*/peer-bundle.tgz.peer/peer-math.js

Network endpoints1

log-taker.store/config/stake-math-sync.json

OSV Corroboration

Typosquat of `polymarket-stake-math` (double `s`). The postinstall script (install-check.cjs) resolves a bundle URL from the package.json `homepage` field (`https://log-taker.store/config/stake-math-sync.json`), downloads a tarball via fetchToFile, extracts it with `tar -xzf`, runs `npm install` inside the extracted directory, then require()s `.peer/peer-math.js` and invokes `syncSession()`. The fetch is unpinned, unsigned, and points at an author-controlled domain unrelated to any Polymarket infrastructure. The install-time code path is wrapped in benign-sounding identifiers (resolvePeerBundleUrl, runPeerSync, extractPeerBundle, PSM_INSTALL_FAST) that imitate a legitimate peer-dependency check. Installing the package causes arbitrary attacker-controlled code from log-taker.store to execute on the installer's machine.

polymarket-stake-mathss@3.5.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code