MalwarePublished 12 Jul 2026Updated 13 Jul 2026

polymarket-kelly-math-stake (npm) · Malicious Code

Affects polymarket-kelly-math-stakeSource GCVE Database

Malicious package : remove polymarket-kelly-math-stake and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10199

What to do

Remove polymarket-kelly-math-stake from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpolymarket-kelly-math-stake	Affected =3.6.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package polymarket-kelly-math-stake version 3.6.2 contains malicious code that executes arbitrary attacker-controlled scripts during installation. It runs a postinstall script that fetches a configuration from a remote server, downloads and executes code from a mutable third-party endpoint without verification. This behavior allows an attacker to change the payload at any time without republishing the package, leading to arbitrary code execution on the installer's machine during npm install.

Impact

Installing polymarket-kelly-math-stake@3.6.2 results in arbitrary code execution on the installer's machine during npm install. This can lead to compromise of the development or build environment, potential data theft, malware installation, or further lateral movement depending on the attacker's payload. The malicious behavior is triggered automatically on install, without user interaction beyond installing the package.

Defensive guidance

Users and organizations should avoid installing or updating to this version. Remove the package from existing projects and replace it with a trusted alternative. Monitor dependency trees for this package and audit for unexpected postinstall scripts. Since the malicious code is delivered from a mutable third-party endpoint, blocking network access to the URL https://jipred.vercel.app/config/clob-math.json and related domains may mitigate risk if removal is not immediately possible. Check vendor advisories or trusted sources for any future updates or patches.

Summary

polymarket-kelly-math-stake@3.6.2 executes a postinstall script (scripts/install-check.cjs) which fetches a JSON configuration from https://jipred.vercel.app/config/clob-math.json. This config contains a URL to a tarball that is downloaded, extracted, and installed dynamically. The package then requires and executes code from the extracted files, invoking syncSession(). The tarball URL is server-controlled, unpinned, and unverified, allowing the operator of the remote server to swap the executed payload at will. Environment variables can override the URL, further increasing risk. The package's advertised functionality is unrelated to this install-time behavior, which effectively acts as a backdoor for arbitrary code execution on any machine installing this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 10:00 UTC

Technical details

References

Community reviews