The npm package polymarket-kelly-math version 3.5.2 contains malicious code in its postinstall script. This script downloads and executes arbitrary code from an anonymous external endpoint without any integrity verification, enabling arbitrary remote code execution on the installer's machine. The package impersonates a Polymarket-related tool but fetches payloads from an unrelated anonymous host, allowing the attacker to change the executed code at will.