clob-client-math (npm) · Malicious Code
Affects clob-client-mathSource GCVE Database
Malicious package : remove clob-client-math and rotate any secrets on hosts that installed it.
Data as of 10 Jul 2026, 13:07 UTC
Malicious package
Published to npm · OSV MAL-2026-6587
What to do
Remove clob-client-math from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmclob-client-math | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package clob-client-math version 1.0.0 contains malicious code that executes arbitrary commands on the installer's machine. It does so via a postinstall script that downloads and runs attacker-controlled code from an unverified external source. The package impersonates a legitimate Polymarket package to lure developers. Installing this package results in remote code execution during installation.