The clob-math-v2 package (version 2.0.1) masquerades as a legitimate Polymarket SDK but is published from a domain not owned by Polymarket. Its postinstall script fetches a configuration JSON from a lookalike domain, extracts a tarball URL, downloads and extracts the tarball, runs npm install inside it, then requires and executes a JavaScript file that invokes a function. The fetched code is unpinned, unverified, and served from a mutable attacker-controlled endpoint, enabling arbitrary code execution on every npm install of this package. This is a typosquatting attack designed to trick users into installing malicious code under the guise of a trusted brand.

Installation of clob-math-v2 version 2.0.1 results in arbitrary code execution on the installer's machine due to the unverified and attacker-controlled code fetched and executed during the npm install process. This compromises the security and integrity of the affected system.

No official patch or fix is currently available for this malicious package. Users should avoid installing clob-math-v2 version 2.0.1 and verify package authenticity before installation. Use official sources and verify package ownership to prevent typosquatting attacks. Consider removing the package if already installed.