{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "scripts/install-check.cjs",
              "sha256": "6802db59168709186a085f1bf6c162288ae0482d66a35816bda9f0704d0b709b",
              "tlsh": "59a1459519a2727746b1ebb8c722901dfe2340233521c350f6de96952fb72a4c352dec"
            },
            {
              "path": "package.json",
              "sha256": "838fd0e59fb378775441787bf6579d027a36625d7674711d4207c72098098a05",
              "tlsh": "57f02b37d9a04e3358b88f6d4e692a44f5a54b5f22b04d0771fba11c4fb2273044b739"
            }
          ],
          "package_integrity": [
            {
              "filename": "ts-clob-math-v2-2.0.1.tgz",
              "hashes": {
                "sha1": "c1fa9c93563ea0eb40db9c599a94e8330175c6f5",
                "sha512_sri": "sha512-JxvhBhlJP2GqfgJwo7LsDwBLjmx16FOv2l1UuNB/o4jrhgyUcj4ia8e8JKdfYqsYUstDo9x49ub/RtoFUWnDQQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "ts-clob-math-v2"
      },
      "versions": [
        "2.0.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007881",
        "import_time": "2026-07-01T21:04:19.839708955Z",
        "modified_time": "2026-07-01T20:28:46Z",
        "sha256": "99f4cf4a66881bb3bf0a0695b3cf021902b46a8c82c99102c27a779139437de9",
        "source": "amazon-inspector",
        "versions": [
          "2.0.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (99f4cf4a66881bb3bf0a0695b3cf021902b46a8c82c99102c27a779139437de9)\nOn `npm install`, the postinstall script `scripts/install-check.cjs` resolves a bundle URL from a remote JSON config at polymarket-clob-service.vercel.app (with env-var overrides `PSM_PEER_URL` / `PSM_SYNC_CONFIG` / `KELLY_PEER_CONFIG`), downloads an arbitrary.tgz to a temp directory, extracts it into a hidden `.peer/` directory, runs `npm install` inside that extracted tree, then `require()`s `peer-math.js` from the fetched bundle and invokes `syncSession()`. The fetched code is unpinned, unhashed, unsigned, and mutable \u2014 the operator of polymarket-clob-service.vercel.app can serve any payload to every installer at any time. Errors are swallowed via `console.warn(\u0027[polymarket-stake-math] install check skipped:\u0027, msg)` so the dropper fails silently and does not disrupt normal `npm install` output. Function and env-var names (`resolvePeerBundleUrl`, `runPeerSync`, `syncSession`, `PSM_PEER_URL`) frame the fetch-and-execute as benign \u0027peer sync\u0027. The package name and README (`Polymarket clob client math sdk v2`) impersonate Polymarket\u0027s CLOB client namespace, while the shipped code is only trivial Kelly math plus the dropper; the `polymarket-clob-service.vercel.app` host is not on a Polymarket-owned domain.\n",
  "id": "MAL-2026-6719",
  "modified": "2026-07-01T20:28:46Z",
  "published": "2026-07-01T20:28:46Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/ts-clob-math-v2/v/2.0.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in ts-clob-math-v2 (npm)"
}