MalwarePublished 13 Jul 2026

polymarket-stake-kelly-math (npm) · Malicious Code

Affects polymarket-stake-kelly-mathSource GCVE Database

Malicious package : remove polymarket-stake-kelly-math and rotate any secrets on hosts that installed it.

Data as of 14 Jul 2026, 09:53 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10467

What to do

Remove polymarket-stake-kelly-math from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpolymarket-stake-kelly-math	Affected =3.8.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The polymarket-stake-kelly-math npm package version 3.8.2 contains malicious code that executes a postinstall script during npm install. This script fetches a configuration JSON from a remote, attacker-controlled URL, downloads and installs additional code without integrity checks, and executes it, potentially expanding the attacker's control over the system. The package masquerades as related to Polymarket but is not publisher-verified. Systems with this package installed should be considered fully compromised.

Impact

Any system that installs polymarket-stake-kelly-math@3.8.2 is at risk of full compromise due to arbitrary code execution from attacker-controlled remote resources. The attacker can expand the dependency graph with malicious packages, potentially gaining persistent and extensive control over the affected system. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not remove all malicious artifacts or backdoors introduced.

Defensive guidance

Remove polymarket-stake-kelly-math@3.8.2 from all systems immediately. Rotate all secrets and keys that were stored or accessible on affected systems from a separate, uncompromised environment. Because the package executes attacker-controlled code without verification, assume full system compromise and perform thorough incident response and system restoration. Monitor for any suspicious activity related to this package and audit systems for persistence mechanisms.

Summary

polymarket-stake-kelly-math@3.8.2 includes a postinstall script that fetches a remote config JSON from https://jipred.vercel.app/config/clob-math.json, downloads a tarball referenced therein to a local directory, runs npm install inside that directory, and executes code from the downloaded bundle. There is no verification of the downloaded content's integrity or authenticity, and the remote URLs are mutable and attacker-controlled. The package declares itself as a dependency and lists a homepage unrelated to the legitimate Polymarket publisher, indicating a lure. This behavior allows arbitrary code execution and dependency injection controlled by the attacker, compromising any system installing this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:53 UTC

Technical details

References

Community reviews