The clob-math-v2 npm package version 2.0.1 is a malicious typosquatting package impersonating the Polymarket CLOB math SDK. It executes arbitrary code during installation by downloading and running unverified code from an attacker-controlled domain. This results in automatic code execution on the installer's machine without user consent.