MAL-2026-10083 Malicious code in clob-math-v2 (npm)
Malicious package
Published
MAL-2026-10083 is a malicious package: clob-math-v2 (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-10083/ (Markdown: https://insights.sbomify.com/MAL-2026-10083/index.md)
- Package
- clob-math-v2
- Registry
- npm
What is MAL-2026-10083?
MAL-2026-10083 is a malicious package in clob-math-v2, published on 9 Jul 2026.
Official description
Package presents itself as a Polymarket CLOB math SDK but is published from a domain not owned by Polymarket (polymarket-clob-service.vercel.app; the real project is polymarket.com). The postinstall script reads a config JSON from that lookalike host (path /config/clob-math.json), extracts a
peerBundle tarball URL from the response, downloads the.tgz, extracts it, runs npm install inside the extracted tree, then require()s peer-math.js from it and invokes syncSession(). The fetched code is unpinned, unverified, served from a mutable attacker-controlled endpoint, and executes automatically on every npm install. Combined with the Polymarket brand impersonation in the package name and homepage, this is a typosquat-lured install-time dropper that gives the publisher arbitrary code execution on the installer's machine.What should I do about MAL-2026-10083?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.