The [email protected] npm package includes a postinstall script (install-check.cjs) which fetches a JSON configuration from an untrusted URL hosted on a free Vercel subdomain unrelated to the legitimate Polymarket infrastructure. This JSON contains a URL to a tarball which the script downloads, extracts, and installs via npm, then requires and executes a JavaScript file (peer-math.js) invoking syncSession(). Because the fetched content is unpinned and unverified, the attacker controls the code executed at install time. The package name and README are crafted to mimic Polymarket's official packages, misleading developers. This results in arbitrary code execution on the installer's machine during package installation.

Installing [email protected] leads to arbitrary code execution on the installer's system due to the unverified, attacker-controlled postinstall script. This compromises the security and integrity of the development environment and potentially any systems the installer has access to.

No official patch or fix is currently available for [email protected]. Users should avoid installing this package entirely. Verify package authenticity before installation, especially for packages mimicking well-known projects. Use trusted sources and package signatures when possible. Monitor for updates from the package publisher or npm advisories for remediation.