MAL-2026-12811

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5b4393db175757c3875327bbe006eb3b34e669ed8c899b9b1e482d93caeed7e8) The package's postinstall script (scripts/install-check.cjs) reads a bundle URL from https://polymarket-clob-service.vercel.app/config/clob-math.json, downloads the referenced.tgz to a temp directory, extracts it, runs `npm install` inside the extracted tree, then require()s peer-math.js from it and invokes syncSession() at install time. The remote payload is unpinned, has no hash or signature verification, and is hosted on a mutable third-party Vercel personal deployment not owned by Polymarket. Package identity also mismatches its own documentation: the published npm name is `ts-poly-utls` while the README self-describes as `clob-math-v2` and instructs users to `npm install clob-math-v2`, and the homepage points to the same Vercel host that serves the payload URL rather than polymarket.com. Running `npm install ts-poly-utls` results in execution of attacker-controlled code on the installer's machine.