[email protected] includes a postinstall script that fetches a remote config JSON from https://jipred.vercel.app/config/clob-math.json, downloads a tarball referenced therein to a local directory, runs npm install inside that directory, and executes code from the downloaded bundle. There is no verification of the downloaded content's integrity or authenticity, and the remote URLs are mutable and attacker-controlled. The package declares itself as a dependency and lists a homepage unrelated to the legitimate Polymarket publisher, indicating a lure. This behavior allows arbitrary code execution and dependency injection controlled by the attacker, compromising any system installing this package.

Any system that installs [email protected] is at risk of full compromise due to arbitrary code execution from attacker-controlled remote resources. The attacker can expand the dependency graph with malicious packages, potentially gaining persistent and extensive control over the affected system. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not remove all malicious artifacts or backdoors introduced.

Remove [email protected] from all systems immediately. Rotate all secrets and keys that were stored or accessible on affected systems from a separate, uncompromised environment. Because the package executes attacker-controlled code without verification, assume full system compromise and perform thorough incident response and system restoration. There is no official patch or fix available; avoid using this package version or any untrusted forks. Monitor for any suspicious activity related to this package and audit systems for persistence mechanisms.