The npm package polymarket-stake-mathss (version 3.5.2) is a typosquatting malicious package that executes attacker-controlled code during installation. It uses a postinstall script to download and run code from an external, unauthorized domain unrelated to the legitimate Polymarket infrastructure. This results in arbitrary code execution on the installer's machine.