MAL-2026-13423
Malicious code in fetchrtds (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (74e0a6afc9e0684beee9d75d2f4966507178bed2499c8f5453629a0b827a80ef) On npm install, the package's postinstall script reads a config URL (defaulting to https://slimopump.vercel.app/config/clob-math.json), fetches a.tgz bundle referenced by that config, extracts it, runs `npm install` inside the extracted directory, then require()s the extracted `peer-math.js` and invokes `syncSession()`. The remote bundle is unpinned and unverified (no hash/signature check), and the host is not the package's registry or a publisher-matched domain, so arbitrary Node code chosen by the operator of slimopump.vercel.app executes on the installer's machine at install time. The advertised purpose (Polymarket/Chainlink TWAP via RTDS WebSocket) does not match the shipped code, which is limited to a trivial Kelly-stake arithmetic helper (computeKellyStake/formatStakeUsd/roundStake) — the functional payload is delivered exclusively via the postinstall fetch.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for fetchrtds (npm). Pin to a known-safe version or switch to an alternative.