MAL-2026-12811

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-poly-utls/MAL-2026-12811.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12811
Published
2026-08-05T13:33:47Z
Modified
2026-08-05T14:37:26.342571141Z
Summary
Malicious code in ts-poly-utls (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5b4393db175757c3875327bbe006eb3b34e669ed8c899b9b1e482d93caeed7e8)

The package's postinstall script (scripts/install-check.cjs) reads a bundle URL from https://polymarket-clob-service.vercel.app/config/clob-math.json, downloads the referenced.tgz to a temp directory, extracts it, runs npm install inside the extracted tree, then require()s peer-math.js from it and invokes syncSession() at install time. The remote payload is unpinned, has no hash or signature verification, and is hosted on a mutable third-party Vercel personal deployment not owned by Polymarket. Package identity also mismatches its own documentation: the published npm name is ts-poly-utls while the README self-describes as clob-math-v2 and instructs users to npm install clob-math-v2, and the homepage points to the same Vercel host that serves the payload URL rather than polymarket.com. Running npm install ts-poly-utls results in execution of attacker-controlled code on the installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:33:47Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014978",
            "import_time": "2026-08-05T14:19:48.754657082Z",
            "sha256": "5b4393db175757c3875327bbe006eb3b34e669ed8c899b9b1e482d93caeed7e8",
            "versions": [
                "1.2.4"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ts-poly-utls

Package

Name
ts-poly-utls
View open source insights on deps.dev
Purl
pkg:npm/ts-poly-utls

Affected ranges

Affected versions

1.*
1.2.4

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-poly-utls/MAL-2026-12811.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "ts-poly-utls-1.2.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-Ak5BfqGc8MFlM+FLVFz3zkGGSCg9kuMiD2dMwglS1qyh6JiqWYFfmzhVPk+AUXtEZC/Tz5Tl0BzO5eYIHnykKQ==",
                "sha1": "9aa70b05ec716d07a84794122862531204f2c6ee"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "59a1459519a2727746b1ebb8c722901dfe2340233521c350f6de96952fb72a4c352dec",
            "sha256": "6802db59168709186a085f1bf6c162288ae0482d66a35816bda9f0704d0b709b",
            "path": "scripts/install-check.cjs"
        },
        {
            "tlsh": "fdf0f637d9604e3628b8df9d4e652a44f5654b5f22b04c0b70fba11c4fb12a2044bb2a",
            "sha256": "8e2ab7a87562688f2823a90b15fe72b0be43896c0fa8c94bf2dc61bdd71b1f92",
            "path": "package.json"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]