kelly-stake-sizing

GHSA-3p9m-p3v6-vcp3

Malicious code in kelly-stake-sizing (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.1`

## Source: amazon-inspector (6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d)
[email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from https://pm-trading-tool-be.vercel.app/config/clob-math.json, resolves a bundle URL from it, downloads a.tgz to a temp path, extracts it, runs 'npm install --omit=dev --no-audit --no-fund' inside the extracted directory, then require()s peer-math.js from the extracted bundle and invokes syncSession(). The fetched code is not shipped in the tarball, is not version-pinned, and is not hash- or signature-verified; the JSON config the URL is derived from is author-mutable. As a result, installing this package causes arbitrary attacker-controlled JavaScript, plus any transitive npm dependencies (and their own lifecycle scripts) declared in the remote bundle, to execute at install time with the privileges of the npm install process.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/72e5d8219b286d7332c4ad2364b87986138cf34c/osv/malicious/npm/kelly-stake-sizing/MAL-2026-14432.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/72e5d8219b286d7332c4ad2364b87986138cf34c/osv/malicious/npm/kelly-stake-sizing/MAL-2026-14432.json
- https://www.npmjs.com/package/kelly-stake-sizing/v/0.1.1
- https://github.com/advisories/GHSA-3p9m-p3v6-vcp3

Compromised versions (1)

= 0.1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.