The npm package clob-client-math version 1.0.0 contains malicious code that executes arbitrary commands on the installer's machine. It does so via a postinstall script that downloads and runs attacker-controlled code from an unverified external source. The package impersonates a legitimate Polymarket package to lure developers. Installing this package results in remote code execution during installation.