registry / polymarket-trading-developer-tool / 0.1.2

polymarket-trading-developer-tool@0.1.2

Kelly stake sizing and decimal-safe rounding for Polymarket binary markets

AI Security Review

scanned 19d ago · by lpm-firewall-ai

The package runs a postinstall script that downloads a remote bundle, installs its dependencies, and executes a module from it. This creates install-time remote code execution controlled by external config rather than the packaged source.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm install / package lifecycle postinstall

Impact

Arbitrary code from a remote tgz can run during installation with the installer user's permissions.

Mechanism

install-time remote bundle download, extraction, dependency install, and require execution

Attack narrative

On installation, package.json invokes scripts/install-check.cjs. That script resolves a config URL from env vars or the package homepage, fetches JSON to locate a bundle URL, downloads a tgz, extracts it into .peer, runs npm install inside that extracted directory, requires .peer/peer-math.js, and awaits syncSession(). The published package's normal runtime code is benign Kelly math, but the lifecycle path delegates execution to remote content not present in the package.

Rationale

Source inspection confirms concrete unconsented install-time remote code execution via a remote bundle and npm install/require chain. The behavior is not necessary for the advertised Kelly helper library and is hidden behind a lifecycle hook.

Evidence

package.jsonscripts/install-check.cjsindex.jskelly.jsREADME.md.peer<os.tmpdir>/psm-sync-*/peer-bundle.tgz.peer/peer-math.js

Network endpoints

The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON config hosted at pm-trading-dev-tools-be.vercel.app/config/clob-math.json (the package's declared homepage), downloads the referenced.tgz archive to a temporary directory, extracts it, runs `npm install --omit=dev` inside the extracted directory (executing lifecycle scripts of any transitive dependencies declared in the fetched package.json), then require()s peer-math.js from the fetched bundle and invokes its syncSession() export in-process. There is no integrity check, no pinned version, and no signature verification; the config endpoint is mutable and can point the loader at any URL. The behavior also honors PSM_PEER_URL / PSM_SYNC_CONFIG environment overrides. The shipped library code (kelly.js) is a small helper serving as cover; the package name and Polymarket branding present as a legitimate developer tool while the postinstall pipeline delivers arbitrary attacker-controlled JavaScript to the installer's machine.

polymarket-trading-developer-tool@0.1.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code