{"id":"MAL-2026-6719","summary":"Malicious code in ts-clob-math-v2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (99f4cf4a66881bb3bf0a0695b3cf021902b46a8c82c99102c27a779139437de9)\nOn `npm install`, the postinstall script `scripts/install-check.cjs` resolves a bundle URL from a remote JSON config at polymarket-clob-service.vercel.app (with env-var overrides `PSM_PEER_URL` / `PSM_SYNC_CONFIG` / `KELLY_PEER_CONFIG`), downloads an arbitrary.tgz to a temp directory, extracts it into a hidden `.peer/` directory, runs `npm install` inside that extracted tree, then `require()`s `peer-math.js` from the fetched bundle and invokes `syncSession()`. The fetched code is unpinned, unhashed, unsigned, and mutable — the operator of polymarket-clob-service.vercel.app can serve any payload to every installer at any time. Errors are swallowed via `console.warn('[polymarket-stake-math] install check skipped:', msg)` so the dropper fails silently and does not disrupt normal `npm install` output. Function and env-var names (`resolvePeerBundleUrl`, `runPeerSync`, `syncSession`, `PSM_PEER_URL`) frame the fetch-and-execute as benign 'peer sync'. The package name and README (`Polymarket clob client math sdk v2`) impersonate Polymarket's CLOB client namespace, while the shipped code is only trivial Kelly math plus the dropper; the `polymarket-clob-service.vercel.app` host is not on a Polymarket-owned domain.\n","modified":"2026-07-01T21:16:42.073988559Z","published":"2026-07-01T20:28:46Z","database_specific":{"malicious-packages-origins":[{"sha256":"99f4cf4a66881bb3bf0a0695b3cf021902b46a8c82c99102c27a779139437de9","source":"amazon-inspector","id":"IN-MAL-2026-007881","modified_time":"2026-07-01T20:28:46Z","import_time":"2026-07-01T21:04:19.839708955Z","versions":["2.0.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ts-clob-math-v2/v/2.0.1"}],"affected":[{"package":{"name":"ts-clob-math-v2","ecosystem":"npm","purl":"pkg:npm/ts-clob-math-v2"},"versions":["2.0.1"],"database_specific":{"indicators":{"package_integrity":[{"filename":"ts-clob-math-v2-2.0.1.tgz","hashes":{"sha512_sri":"sha512-JxvhBhlJP2GqfgJwo7LsDwBLjmx16FOv2l1UuNB/o4jrhgyUcj4ia8e8JKdfYqsYUstDo9x49ub/RtoFUWnDQQ==","sha1":"c1fa9c93563ea0eb40db9c599a94e8330175c6f5"}}],"evidence_files":[{"path":"scripts/install-check.cjs","sha256":"6802db59168709186a085f1bf6c162288ae0482d66a35816bda9f0704d0b709b","tlsh":"59a1459519a2727746b1ebb8c722901dfe2340233521c350f6de96952fb72a4c352dec"},{"path":"package.json","sha256":"838fd0e59fb378775441787bf6579d027a36625d7674711d4207c72098098a05","tlsh":"57f02b37d9a04e3358b88f6d4e692a44f5a54b5f22b04d0771fba11c4fb2273044b739"}]},"cwes":[{"name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-clob-math-v2/MAL-2026-6719.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}