MAL-2026-6720

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-elinter/MAL-2026-6720.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6720
Published
2026-07-01T20:28:27Z
Modified
2026-07-01T21:16:42Z
Summary
Malicious code in ts-elinter (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ce2fcb236f368214aa75fe60d233081a72077737e856e403c15d44fe9c940767)

On npm install, the package's postinstall script (scripts/install-check.cjs) fetches a JSON pointer from https://trabalhos-flax.vercel.app/config/clob-math.json, downloads the referenced.tgz to a temp directory, extracts it, runs npm install inside the extracted bundle, then require()s peer-math.js and invokes syncSession(). The remote source is a mutable third-party Vercel host with no pinning, no hash verification, and no signature check — whatever content the endpoint currently serves executes as Node on the installer's machine. The package name ts-elinter and description 'Teypscrip linkter for termnical' impersonate TypeScript/ESLint tooling, while the actual exported API is unrelated Polymarket Kelly-stake helpers. Cover-story naming (peer-math.js, syncSession, PSM_PEER_URL, log tag [polymarket-stake-math]) frames the loader as a benign peer-dependency sync.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-007879",
            "import_time":  "2026-07-01T21:04:19.66317529Z",
            "modified_time":  "2026-07-01T20:28:27Z",
            "sha256":  "ce2fcb236f368214aa75fe60d233081a72077737e856e403c15d44fe9c940767",
            "source":  "amazon-inspector",
            "versions":  [
                "3.3.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ts-elinter

Package

Name
ts-elinter
View open source insights on deps.dev
Purl
pkg:npm/ts-elinter

Affected ranges

Affected versions

3.*
3.3.9

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "scripts/install-check.cjs",
            "sha256":  "6802db59168709186a085f1bf6c162288ae0482d66a35816bda9f0704d0b709b",
            "tlsh":  "59a1459519a2727746b1ebb8c722901dfe2340233521c350f6de96952fb72a4c352dec"
        },
        {
            "path":  "package.json",
            "sha256":  "31657d1ba20e0d6d4e0bbd3f7b808afd671c4390a4a37fde7e11dbf7effb253f",
            "tlsh":  "59f08b37ded04d3328b88a194d695104f0654f5f22b08c07b0bb600c0fb22b3088b32a"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "ts-elinter-3.3.9.tgz",
            "hashes":  {
                "sha1":  "cf557a2b2ae89a2d39d999e88e3fd1339ccfb29a",
                "sha512_sri":  "sha512-JK9gldbmVAZGJ5KkgKPTrQU1SZQeM05XM3VHcTBrN57DY/R9oLXejEFrk0rXqRj7gtXSXsVEJR9Y1TlehEPAHg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-elinter/MAL-2026-6720.json"