MAL-2026-6439

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/polymarket-stake-maths/MAL-2026-6439.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6439
Published
2026-06-25T05:56:40Z
Modified
2026-06-25T06:31:21.580800027Z
Summary
Malicious code in polymarket-stake-maths (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (657363aaa0b94385d30a26c1f4ee67923b0d877975850ad08f8364c2a901d8e7)

On npm install, the package's postinstall script (scripts/install-check.cjs) fetches a JSON config from https://log-taker.store/config/stake-math-sync.json, reads a peerBundle URL from that config, downloads the referenced.tgz, extracts it into a .peer/ directory, runs npm install --omit=dev inside the extracted tree, and then require()s peer-math.js and invokes syncSession(). There is no pinning, no hash or signature verification, and the config host is fully attacker-mutable, so every install executes whatever bytes log-taker.store is currently serving. The nested npm install is an independent execution vector: any lifecycle hook declared in the attacker-supplied package.json runs with the installer's privileges. The cover-story naming (peerBundle, syncSession, install-check, PSM_INSTALL_FAST) and the two-hop config-then-bundle indirection keep the actual payload URL out of the published tarball, defeating naive registry scans. The README advertises only Kelly stake math helpers; remote code execution is not part of the stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "3.5.2"
            ],
            "sha256": "657363aaa0b94385d30a26c1f4ee67923b0d877975850ad08f8364c2a901d8e7",
            "import_time": "2026-06-25T06:26:40.897244986Z",
            "modified_time": "2026-06-25T05:56:40Z",
            "id": "IN-MAL-2026-007461",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / polymarket-stake-maths

Package

Name
polymarket-stake-maths
View open source insights on deps.dev
Purl
pkg:npm/polymarket-stake-maths

Affected ranges

Affected versions

3.*
3.5.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "polymarket-stake-maths-3.5.2.tgz",
            "hashes": {
                "sha1": "3965cfa96a682ad1ca4b315ea1dc40f4c496b2fa",
                "sha512_sri": "sha512-0P70OrgoUfoqfSdxb1Ci8pkTDoEeuCWChXi/p+ZousFKAPhd+lX6cXKvbl1WwPQ5ffU+IuG3QggZCvptelZqkw=="
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "01a1559519a2727346b1ebb8c722941eff2340233561c360f6de96952fb72a4c352dec",
            "sha256": "17bc8d92cdbf9fb042d3874e49b9682d4875bb4c950144485a1df32ad1d4a96e",
            "path": "scripts/install-check.cjs"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/polymarket-stake-maths/MAL-2026-6439.json"