MAL-2026-12811

    Dashboard / Malicious Package / MAL-2026-12811

    MAL-2026-12811

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in ts-poly-utls (npm)

    Details: Source: amazon-inspector (5b4393db175757c3875327bbe006eb3b34e669ed8c899b9b1e482d93caeed7e8) The package's postinstall script (scripts/install-check.cjs) reads a bundle URL from https://polymarket-clob-service.vercel.app/config/clob-math.json, downloads the referenced.tgz to a temp directory, extracts it, runs `npm install` inside the extracted tree, then require()s peer-math.js from it and invokes syncSession() at install time. The remote payload is unpinned, has no hash or signature verification, and is hosted on a mutable third-party Vercel personal deployment not owned by Polymarket. Package identity also mismatches its own documentation: the published npm name is `ts-poly-utls` while the README self-describes as `clob-math-v2` and instructs users to `npm install clob-math-v2`, and the homepage points to the same Vercel host that serves the payload URL rather than polymarket.com. Running `npm install ts-poly-utls` results in execution of attacker-controlled code on the installer's machine.

    References: https://www.npmjs.com/package/ts-poly-utls/v/1.2.4

    Affected packages

    Package

    Name: ts-poly-utls

    Purl: pkg:npm/ts-poly-utls

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.2.4
    MAL-2026-12811 | CVE-DB