MAL-2026-10069

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/polymarket-kelly-maths/MAL-2026-10069.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10069
Published
2026-07-09T15:47:37Z
Modified
2026-07-09T16:32:00Z
Summary
Malicious code in polymarket-kelly-maths (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dc23601d9ca932f0a36a1a6e7115e37da1e984b1adf3b39b9612b72f5a3cf90f)

The package's postinstall script (install-check.cjs) resolves a bundle URL from a remote JSON config at https://jipred.vercel.app/config/clob-math.json (derived from package.json homepage), downloads a.tgz bundle, extracts it into a.peer directory, runs npm install inside the extracted directory, then require()s peer-math.js from the bundle and invokes syncSession(). The bundle URL is unpinned and mutable; no hash or signature verification is performed. The fetch destination is a vercel-hosted host unrelated to any established npm publisher, and the framing (peer bundle sync, install check skipped warnings) presents the fetch-and-execute as a benign peer-dependency check. The package name differs by a single trailing character from polymarket-kelly-math, which it also declares as its sole dependency, indicating typosquat namespace abuse layered on top of the dropper. Any machine running npm install polymarket-kelly-maths executes attacker-controlled code fetched from jipred.vercel.app at install time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-009233",
            "import_time": "2026-07-09T16:20:53.145040085Z",
            "modified_time": "2026-07-09T15:47:37Z",
            "sha256": "dc23601d9ca932f0a36a1a6e7115e37da1e984b1adf3b39b9612b72f5a3cf90f",
            "source": "amazon-inspector",
            "versions": [
                "3.5.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / polymarket-kelly-maths

Package

Name
polymarket-kelly-maths
View open source insights on deps.dev
Purl
pkg:npm/polymarket-kelly-maths

Affected ranges

Affected versions

3.*
3.5.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "scripts/install-check.cjs",
            "sha256": "3e15f1692c4075cf29cefa94c84d564a95086ab7a6838a97ea25cd02475a282d",
            "tlsh": "6ad1659915a272770bb0e7a4cb53a41eeb6394233511c364f6cdc6952ff6164c213dec"
        },
        {
            "path": "package.json",
            "sha256": "fb2d07f84fb6c80fdf3bd1a2ed8344c886de07b59cd02e615a5934f1c2e796ad",
            "tlsh": "c6012637da608e3624b89edd4ea91645f5610b0f72b04d0bb0bba11c8b72173045bb39"
        }
    ],
    "package_integrity": [
        {
            "filename": "polymarket-kelly-maths-3.5.3.tgz",
            "hashes": {
                "sha1": "9078995cc2e4fe7fa91c7ab0d2016a6c8af4629a",
                "sha512_sri": "sha512-hSyPmWJMkBoXqD1yWUZ6YEEp8fCbk0JiB0lpxUh1OV8adSh+iaPd4ZUkq5URw9vl5ldFc2qhVbbzjhkD7ShXSw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/polymarket-kelly-maths/MAL-2026-10069.json"