polymarket-stake-mathssnpm

Typosquat of polymarket-stake-math (double s). The postinstall script (install-check.cjs) resolves a bundle URL from the package.json homepage field (https://log-taker.store/config/stake-math-sync.json), downloads a tarball via fetchToFile, extracts it with tar -xzf, runs npm install inside the extracted directory, then require()s .peer/peer-math.js and invokes syncSession(). The fetch is unpinned, unsigned, and points at an author-controlled domain unrelated to any Polymarket infrastructure. The install-time code path is wrapped in benign-sounding identifiers (resolvePeerBundleUrl, runPeerSync, extractPeerBundle, PSM_INSTALL_FAST) that imitate a legitimate peer-dependency check. Installing the package causes arbitrary attacker-controlled code from log-taker.store to execute on the installer's machine.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.