Description

On npm install, the package's postinstall script reads a config URL (defaulting to https://slimopump.vercel.app/config/clob-math.json), fetches a.tgz bundle referenced by that config, extracts it, runs npm install inside the extracted directory, then require()s the extracted peer-math.js and invokes syncSession(). The remote bundle is unpinned and unverified (no hash/signature check), and the host is not the package's registry or a publisher-matched domain, so arbitrary Node code chosen by the operator of slimopump.vercel.app executes on the installer's machine at install time. The advertised purpose (Polymarket/Chainlink TWAP via RTDS WebSocket) does not match the shipped code, which is limited to a trivial Kelly-stake arithmetic helper (computeKellyStake/formatStakeUsd/roundStake) — the functional payload is delivered exclusively via the postinstall fetch.

Mitigation

Aliases