The npm package polymarket-math-stake-kelly version 3.7.2 contains malicious code executed during installation. Its postinstall script downloads and runs unverified JavaScript from an external URL with installer's privileges, potentially enabling arbitrary code execution. The package's manifest also lists itself as a dependency, which can cause repeated execution of the malicious install hook.