The 'neon-poly-utls' npm package (version 1.3.1) includes a postinstall script that reads a URL from its package.json homepage field, fetching a JSON configuration from a Vercel app not owned by the legitimate Polymarket publisher. This JSON points to a peer bundle tarball which is downloaded, extracted, and installed automatically during npm install. The script then requires and executes code from the extracted bundle, invoking a function that can run arbitrary Node.js code. The remote artifact is mutable, lacks hash or signature verification, and the package disguises itself as 'clob-math-v2', misleading users. Errors during this process are suppressed, allowing silent execution of potentially malicious payloads at install time.

This vulnerability allows arbitrary code execution on any machine that installs the affected package version, potentially leading to full compromise of the install environment. Because the malicious code runs during npm install, it can execute with the privileges of the user running the installation. The unverified remote code fetch and execution create a high risk of supply chain compromise.

No official patch or fix is currently available for this malicious package version. Users should avoid installing 'neon-poly-utls' version 1.3.1 and any similarly named packages impersonating legitimate SDKs. Verify package authenticity before installation and prefer official sources. Monitor for vendor advisories for updates or removals. Since this is a malicious package, removing it from projects and dependency trees is recommended.