취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913)

awesome-terminal@1.0.3 ships a postinstall script (scripts/install-check.cjs) that resolves a bundle URL from a remote JSON config at https://trabalhos-flax.vercel.app/config/clob-math.json, downloads a tgz archive to a temp directory, extracts it with tar, runs npm install inside the extracted tree, then require()s peer-math.js and invokes syncSession(). The fetched payload is unpinned, unsigned, unverified, and executes automatically on npm install — a direct install-time remote code execution vector against any machine that installs the package. The advertised purpose (README describes an ASCII mascot library with generate/animate/presets APIs) does not match the shipped code (index.js/kelly.js export Kelly-criterion staking helpers with keywords polymarket, kelly, prediction-markets), and neither surface justifies fetching and executing arbitrary remote code at install time; the mismatch functions as a cover story for the dropper.