The polymarket-stake-kelly-math npm package version 3.8.2 contains malicious code that executes a postinstall script during npm install. This script fetches a configuration JSON from a remote, attacker-controlled URL, downloads and installs additional code without integrity checks, and executes it, potentially expanding the attacker's control over the system. The package masquerades as related to Polymarket but is not publisher-verified. Systems with this package installed should be considered fully compromised.