Malicious code in kelly-stake (npm)

Source: amazon-inspector 350ccf4a19896a23680e7478be01909de7f16057f175dc14de1d4e0bb92ad540 On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: it fetches a JSON config from https://www.zscdao.help/config/stake-math-sync.json,...

Malicious code in ts-clob-math-v2 (npm)

Source: amazon-inspector 99f4cf4a66881bb3bf0a0695b3cf021902b46a8c82c99102c27a779139437de9 On npm install, the postinstall script scripts/install-check.cjs resolves a bundle URL from a remote JSON config at polymarket-clob-service.vercel.app with env-var overrides PSMPEERURL / PSMSYNCCONFIG /...

Malicious code in polymarket-kelly-math (npm)

Source: amazon-inspector f4b668f5fa9e3cce1dd0ddee31443ff3e797c19e9343b750dee86ddef888b02a The package's postinstall script scripts/install-check.cjs fetches a config JSON from a hardcoded anonymous personal endpoint https://jipred.vercel.app/config/clob-math.json, reads a.tgz bundle URL from that...

Malicious code in polymarket-math-stake-kelly (npm)

Source: amazon-inspector 408b5fd87b4b328671330e1ddb9333eb5d68d9a873f30237bd886a7632f038b5 [email protected] runs scripts/install-check.cjs as a postinstall hook. The script reads a config URL defaulting to https://jipred.vercel.app/config/clob-math.json, downloads a.tgz bundle...

Malicious code in eslintcmd (npm)

Source: amazon-inspector 2cf4500fbbfc85f42275772210ace6efb69c5f90d9d0a5edd7c0c75fa271f0c3 The package's postinstall script scripts/install-check.cjs fetches a JSON config from https://slimopump.vercel.app/config/clob-math.json, downloads the.tgz referenced by that config, extracts it into a.peer/...