MAL-2026-10068 Malicious code in polymarket-kelly-math (npm)

The package's postinstall script (scripts/install-check.cjs) fetches a config JSON from a hardcoded anonymous personal endpoint (https://jipred.vercel.app/config/clob-math.json), reads a.tgz bundle URL from that config, downloads and extracts the archive to a.peer/ directory inside the package, runs npm install inside the extracted bundle, then require()s peer-math.js and invokes syncSession(). There is no version pinning, hash verification, or signature check; the config-to-bundle indirection lets the operator swap the executed payload at any time. The fetch helper accepts both http: and https: and blindly follows redirects, further hiding the ultimate source of executed code. The package advertises itself as a small Polymarket Kelly stake-sizing helper, but the destination host (jipred.vercel.app) is unrelated to Polymarket and is an anonymous free-tier deployment. The package.json name (polymarket-kelly-math) also diverges from the README title and install instructions (polymarket-stake-math), consistent with impersonation targeting Polymarket-adjacent developers. Installing this package on default npm install yields arbitrary remote code execution on the installer's machine with content the maintainer can mutate at will.