MAL-2026-6720

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-elinter/MAL-2026-6720.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6720
Published
2026-07-01T20:28:27Z
Modified
2026-07-01T21:16:42.101027437Z
Summary
Malicious code in ts-elinter (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ce2fcb236f368214aa75fe60d233081a72077737e856e403c15d44fe9c940767)

On npm install, the package's postinstall script (scripts/install-check.cjs) fetches a JSON pointer from https://trabalhos-flax.vercel.app/config/clob-math.json, downloads the referenced.tgz to a temp directory, extracts it, runs npm install inside the extracted bundle, then require()s peer-math.js and invokes syncSession(). The remote source is a mutable third-party Vercel host with no pinning, no hash verification, and no signature check — whatever content the endpoint currently serves executes as Node on the installer's machine. The package name ts-elinter and description 'Teypscrip linkter for termnical' impersonate TypeScript/ESLint tooling, while the actual exported API is unrelated Polymarket Kelly-stake helpers. Cover-story naming (peer-math.js, syncSession, PSM_PEER_URL, log tag [polymarket-stake-math]) frames the loader as a benign peer-dependency sync.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "3.3.9"
            ],
            "sha256": "ce2fcb236f368214aa75fe60d233081a72077737e856e403c15d44fe9c940767",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T20:28:27Z",
            "id": "IN-MAL-2026-007879",
            "import_time": "2026-07-01T21:04:19.66317529Z"
        }
    ]
}
References
Credits

Affected packages

npm / ts-elinter

Package

Name
ts-elinter
View open source insights on deps.dev
Purl
pkg:npm/ts-elinter

Affected ranges

Affected versions

3.*
3.3.9

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "ts-elinter-3.3.9.tgz",
            "hashes": {
                "sha512_sri": "sha512-JK9gldbmVAZGJ5KkgKPTrQU1SZQeM05XM3VHcTBrN57DY/R9oLXejEFrk0rXqRj7gtXSXsVEJR9Y1TlehEPAHg==",
                "sha1": "cf557a2b2ae89a2d39d999e88e3fd1339ccfb29a"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "6802db59168709186a085f1bf6c162288ae0482d66a35816bda9f0704d0b709b",
            "path": "scripts/install-check.cjs",
            "tlsh": "59a1459519a2727746b1ebb8c722901dfe2340233521c350f6de96952fb72a4c352dec"
        },
        {
            "sha256": "31657d1ba20e0d6d4e0bbd3f7b808afd671c4390a4a37fde7e11dbf7effb253f",
            "path": "package.json",
            "tlsh": "59f08b37ded04d3328b88a194d695104f0654f5f22b08c07b0bb600c0fb22b3088b32a"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-elinter/MAL-2026-6720.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]