kelly-stake-sizing

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d)
[email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from https://pm-trading-tool-be.vercel.app/config/clob-math.json, resolves a bundle URL from it, downloads a.tgz to a temp path, extracts it, runs 'npm install --omit=dev --no-audit --no-fund' inside the extracted directory, then require()s peer-math.js from the extracted bundle and invokes syncSession(). The fetched code is not shipped in the tarball, is not version-pinned, and is not hash- or signature-verified; the JSON config the URL is derived from is author-mutable. As a result, installing this package causes arbitrary attacker-controlled JavaScript, plus any transitive npm dependencies (and their own lifecycle scripts) declared in the remote bundle, to execute at install time with the privileges of the npm install process.

Compromised versions (1)

• 0.1.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.