Malicious code in polymarket-stake-mathss (npm)
polymarket-stake-mathss is a typosquatting package on npm containing malicious code that executes arbitrary attacker-controlled code during installation via a postinstall script. The script downloads and executes code from an attacker-controlled domain (log-taker.store) unrelated to Polymarket infrastructure.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed polymarket-stake-mathss from npm
- Ecosystems
- Attack vectors
- Affected entities
- polymarket-stake-mathssTyposquat of polymarket-stake-math (double 's')
polymarket-stake-mathss is a typosquatting variant of the legitimate polymarket-stake-math package, distinguished by a double 's' in the name. The package contains a malicious postinstall script (install-check.cjs) that executes during npm installation.
The attack chain works as follows: the postinstall script reads a bundle URL from the package.json homepage field pointing to https://log-taker.store/config/stake-math-sync.json. It then downloads a tarball from this attacker-controlled domain, extracts it using tar, runs npm install inside the extracted directory, and finally requires and invokes code from .peer/peer-math.js.
The malicious code path is obfuscated with benign-sounding function names (resolvePeerBundleUrl, runPeerSync, extractPeerBundle, PSM_INSTALL_FAST) designed to mimic a legitimate peer-dependency check. The fetch is unpinned and unsigned, giving the attacker full control over the downloaded payload. Installation of this package results in arbitrary code execution on the installer's machine.
The incident was identified by the OpenSSF's malicious-packages project and reported via GitHub Security Advisory GHSA-2qqg-9fjr-5mw9.
Indicators of compromise
- Packages
- polymarket-stake-mathss
- Domains
- log-taker.store
Remediation
- Remove polymarket-stake-mathss from all package.json files and lock files
- Audit npm install history to identify systems that installed this package
- Review system logs and process execution on affected machines for signs of compromise
- If installed, assume the system may be compromised and perform a security audit
- Use the legitimate polymarket-stake-math package (single 's') if the functionality is needed
- Enable npm package verification and consider using npm audit to detect similar malicious packages
Sources
- GitHub Advisory GHSA-2qqg-9fjr-5mw9 · GitHub Advisory Database
Cite this entry
"Malicious code in polymarket-stake-mathss (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 10, 2026; last updated August 10, 2026. https://supplychainattack.org/incident/malicious-code-in-polymarket-stake-mathss-npm-nxzyip
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - containedcritical
Malicious code in axios-fast (npm)
axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.
npmCompromised packageTyposquatting