MAL-2026-13707

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/polymarket-stake-mathss/MAL-2026-13707.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13707
Published
2026-08-10T12:45:51Z
Modified
2026-08-10T13:05:01.892301386Z
Summary
Malicious code in polymarket-stake-mathss (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ef71354e27f0e5798fee884366776d5b76ba0df0122148d1f4f7aeeef42b45cc)

Typosquat of polymarket-stake-math (double s). The postinstall script (install-check.cjs) resolves a bundle URL from the package.json homepage field (https://log-taker.store/config/stake-math-sync.json), downloads a tarball via fetchToFile, extracts it with tar -xzf, runs npm install inside the extracted directory, then require()s .peer/peer-math.js and invokes syncSession(). The fetch is unpinned, unsigned, and points at an author-controlled domain unrelated to any Polymarket infrastructure. The install-time code path is wrapped in benign-sounding identifiers (resolvePeerBundleUrl, runPeerSync, extractPeerBundle, PSMINSTALLFAST) that imitate a legitimate peer-dependency check. Installing the package causes arbitrary attacker-controlled code from log-taker.store to execute on the installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017281",
            "import_time": "2026-08-10T12:51:45.988422786Z",
            "sha256": "ef71354e27f0e5798fee884366776d5b76ba0df0122148d1f4f7aeeef42b45cc",
            "modified_time": "2026-08-10T12:45:51Z",
            "source": "amazon-inspector",
            "versions": [
                "3.5.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / polymarket-stake-mathss

Package

Name
polymarket-stake-mathss
View open source insights on deps.dev
Purl
pkg:npm/polymarket-stake-mathss

Affected ranges

Affected versions

3.*
3.5.2

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/polymarket-stake-mathss/MAL-2026-13707.json"
indicators 
{
    "evidence_files": [
        {
            "path": "scripts/install-check.cjs",
            "tlsh": "01a1559519a2727346b1ebb8c722941eff2340233561c360f6de96952fb72a4c352dec",
            "sha256": "17bc8d92cdbf9fb042d3874e49b9682d4875bb4c950144485a1df32ad1d4a96e"
        },
        {
            "path": "package.json",
            "tlsh": "ebf02837d9604d3724b99fad5e691644f4610b5f73a04d0b70bb500c4fb117315ab73a",
            "sha256": "a763f999f0a65ce586f5b2ad5d6decd79926fac060a18147fd61c3320155013e"
        }
    ],
    "package_integrity": [
        {
            "filename": "polymarket-stake-mathss-3.5.2.tgz",
            "hashes": {
                "sha1": "f9bf44b5e528f4562472f75185304bdd67fed87b",
                "sha512_sri": "sha512-7N/s6AswID930cnMNbT38moVgWqosYLZnjLoqWeO8uwPuC6OaoLyzv+P02e3/Pdfom2+ay6zZNL3GmZoDUbfAQ=="
            }
        }
    ]
}