kelly-sizing @0.1.1

Summary

kelly-sizing@0.1.1 ships a postinstall script (install-check.cjs) that fetches a JSON config from pm-trading-dev-tools-be.vercel.app/config/clob-math.json, reads a bundle URL from it, downloads a.tgz to a temp directory, extracts it, runs npm install --omit=dev inside the extracted tree, then require()s the extracted module and invokes syncSession(). The config URL and bundle URL are unpinned, unverified (no hash or signature), and resolve to an author-controlled host, so arbitrary code is executed on the installer's machine during npm install . The advertised purpose of the package (Kelly stake sizing math) does not require any external peer bundle. Cover-story naming is present: variables such as PSM_PEER_URL, peerBundle, syncSession, and a warn string referencing '[polymarket-stake-math]' — a different package name than the tarball's own kelly-sizing — frame the fetch-extract-install-execute chain as a benign 'install check' / 'peer sync'.

Source: amazon-inspector (ede654bccc4eb022f9faa5ceb79107da8ad0b1950db970b62de9771ec11428c4)