MAL-2026-14432
Malicious code in kelly-stake-sizing (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d) kelly-stake-sizing@0.1.1 declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from https://pm-trading-tool-be.vercel.app/config/clob-math.json, resolves a bundle URL from it, downloads a.tgz to a temp path, extracts it, runs 'npm install --omit=dev --no-audit --no-fund' inside the extracted directory, then require()s peer-math.js from the extracted bundle and invokes syncSession(). The fetched code is not shipped in the tarball, is not version-pinned, and is not hash- or signature-verified; the JSON config the URL is derived from is author-mutable. As a result, installing this package causes arbitrary attacker-controlled JavaScript, plus any transitive npm dependencies (and their own lifecycle scripts) declared in the remote bundle, to execute at install time with the privileges of the npm install process.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for kelly-stake-sizing (npm). Pin to a known-safe version or switch to an alternative.