The polymarket-stake-mathss package is a malicious typosquat of the legitimate polymarket-stake-math package. Its postinstall script fetches a tarball from an attacker-controlled domain (https://log-taker.store/config/stake-math-sync.json), extracts it, installs dependencies, and executes a JavaScript file that runs arbitrary code. The malicious code execution occurs at install time, disguised under benign-sounding function names that mimic legitimate peer dependency checks. This unpinned and unsigned fetch allows the attacker to run arbitrary code on any machine that installs this package version 3.5.2.

Installing polymarket-stake-mathss version 3.5.2 results in arbitrary code execution on the installer's system, potentially compromising the system's security and integrity. The attacker-controlled code is fetched and executed without verification, enabling full control over the installation environment.

Avoid installing polymarket-stake-mathss version 3.5.2. Since this is a typosquatting malicious package, users should verify package names carefully before installation. There is no official patch or fix available. Remove any installations of this package and scan affected systems for potential compromise. Monitor package sources and rely only on verified, official packages.