Malicious code in polymarket-math-stake-kelly (npm)

Source: amazon-inspector 408b5fd87b4b328671330e1ddb9333eb5d68d9a873f30237bd886a7632f038b5 [email protected] runs scripts/install-check.cjs as a postinstall hook. The script reads a config URL defaulting to https://jipred.vercel.app/config/clob-math.json, downloads a.tgz bundle...