{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "scripts/install-check.cjs",
              "sha256": "6802db59168709186a085f1bf6c162288ae0482d66a35816bda9f0704d0b709b",
              "tlsh": "59a1459519a2727746b1ebb8c722901dfe2340233521c350f6de96952fb72a4c352dec"
            },
            {
              "path": "package.json",
              "sha256": "31657d1ba20e0d6d4e0bbd3f7b808afd671c4390a4a37fde7e11dbf7effb253f",
              "tlsh": "59f08b37ded04d3328b88a194d695104f0654f5f22b08c07b0bb600c0fb22b3088b32a"
            }
          ],
          "package_integrity": [
            {
              "filename": "ts-elinter-3.3.9.tgz",
              "hashes": {
                "sha1": "cf557a2b2ae89a2d39d999e88e3fd1339ccfb29a",
                "sha512_sri": "sha512-JK9gldbmVAZGJ5KkgKPTrQU1SZQeM05XM3VHcTBrN57DY/R9oLXejEFrk0rXqRj7gtXSXsVEJR9Y1TlehEPAHg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "ts-elinter"
      },
      "versions": [
        "3.3.9"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007879",
        "import_time": "2026-07-01T21:04:19.66317529Z",
        "modified_time": "2026-07-01T20:28:27Z",
        "sha256": "ce2fcb236f368214aa75fe60d233081a72077737e856e403c15d44fe9c940767",
        "source": "amazon-inspector",
        "versions": [
          "3.3.9"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ce2fcb236f368214aa75fe60d233081a72077737e856e403c15d44fe9c940767)\nOn `npm install`, the package\u0027s postinstall script (scripts/install-check.cjs) fetches a JSON pointer from https://trabalhos-flax.vercel.app/config/clob-math.json, downloads the referenced.tgz to a temp directory, extracts it, runs `npm install` inside the extracted bundle, then `require()`s peer-math.js and invokes syncSession(). The remote source is a mutable third-party Vercel host with no pinning, no hash verification, and no signature check \u2014 whatever content the endpoint currently serves executes as Node on the installer\u0027s machine. The package name `ts-elinter` and description \u0027Teypscrip linkter for termnical\u0027 impersonate TypeScript/ESLint tooling, while the actual exported API is unrelated Polymarket Kelly-stake helpers. Cover-story naming (`peer-math.js`, `syncSession`, `PSM_PEER_URL`, log tag `[polymarket-stake-math]`) frames the loader as a benign peer-dependency sync.\n",
  "id": "MAL-2026-6720",
  "modified": "2026-07-01T20:28:27Z",
  "published": "2026-07-01T20:28:27Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/ts-elinter/v/3.3.9"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in ts-elinter (npm)"
}