{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "scripts/install-check.cjs",
              "sha256": "6802db59168709186a085f1bf6c162288ae0482d66a35816bda9f0704d0b709b",
              "tlsh": "59a1459519a2727746b1ebb8c722901dfe2340233521c350f6de96952fb72a4c352dec"
            },
            {
              "path": "package.json",
              "sha256": "98db397311e1a380c88d7842e39839da11f56a6daab2c33fc039a6772d29b41b",
              "tlsh": "edf04437da605d3624bc8e9d8e682a40f8660b1f22b00d1bb5bb61584fb2162085b73a"
            }
          ],
          "package_integrity": [
            {
              "filename": "polymarket-trading-developer-tool-0.1.1.tgz",
              "hashes": {
                "sha1": "a3b62913e42429f82d88eba27be4db16c1f7eb31",
                "sha512_sri": "sha512-7ZwqiUrG5571XmVN52vX0FV+ZVx1mzzHqAokHOokxbyMbjuxuBlgYPPdzK6/VHna6r424wPnW+TwHOBxDdY1lA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "polymarket-trading-developer-tool"
      },
      "versions": [
        "0.1.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007885",
        "import_time": "2026-07-01T21:04:20.02224047Z",
        "modified_time": "2026-07-01T20:37:24Z",
        "sha256": "ef1cd8b921e779a17329eff2166e4ca81602e51e9079399e39157c8cf7aee4ec",
        "source": "amazon-inspector",
        "versions": [
          "0.1.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ef1cd8b921e779a17329eff2166e4ca81602e51e9079399e39157c8cf7aee4ec)\nThe package impersonates Polymarket developer tooling and ships a postinstall script (scripts/install-check.cjs) that, on `npm install`, fetches a JSON config from https://pm-trading-dev-tools-be.vercel.app/config/clob-math.json, reads a `bundle`/`peerBundle`/`url` field from the response, downloads the referenced tarball to a temp directory, extracts it with `tar -xzf --strip-components=1`, runs `npm install` inside the extracted directory, then `require`s `peer-math.js` from it and invokes `syncSession()`. The tarball URL is unpinned, unversioned, unverified (no hash/signature), and served from a mutable author-controlled Vercel host that is not affiliated with Polymarket. The script\u0027s name (`install-check.cjs`) and swallowed error message (`[polymarket-stake-math] install check skipped`) present the behavior as a benign compatibility probe. This is a textbook install-time RCE dropper with a config-indirection layer so the executed payload can be swapped after publish, combined with brand impersonation of Polymarket to amplify reach.\n",
  "id": "MAL-2026-6714",
  "modified": "2026-07-01T20:37:24Z",
  "published": "2026-07-01T20:37:24Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/polymarket-trading-developer-tool/v/0.1.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in polymarket-trading-developer-tool (npm)"
}