The polymarket-kelly-maths npm package version 3.5.3 contains malicious code executed during installation. Its postinstall script fetches and runs attacker-controlled code from an untrusted, mutable URL without verification. The package name is a typosquat variant of a legitimate package, leading to potential accidental installation of this malicious package.