The clob-client-math npm package version 1.0.0 includes a postinstall script that downloads a JSON configuration from an untrusted external URL, which specifies a tarball to fetch and extract. The package then runs npm install inside the extracted directory and executes a JavaScript function from the downloaded code. This remote payload is mutable, unpinned, and unsigned, allowing an attacker to execute arbitrary code on the installer's machine. The package name and README impersonate the legitimate @polymarket/clob-client ecosystem to deceive developers. This constitutes a supply chain attack via a malicious npm package.

Installing clob-client-math version 1.0.0 results in arbitrary code execution on the installer's system, potentially leading to full system compromise, data theft, or further malware deployment. The malicious payload is fetched dynamically and can be changed by the attacker at any time, increasing risk and unpredictability.

Users should avoid installing clob-client-math version 1.0.0. Since no official patch or remediation is indicated, the safest action is to remove this package from any projects and replace it with verified alternatives. Monitor package sources carefully and verify authenticity before installation. No vendor advisory or official fix is currently available; patch status is not yet confirmed — check vendor advisories for updates.