@lightupai/polaris@0.0.175
Record and stream Claude Code sessions to Slack. Like Gong for AI coding — capture every prompt, response, and tool call. Multiplayer collaboration across AI coding agents.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe web app automatically sends signup identities and organization details to an internal Slack channel, and periodically sends signup rollups. This is suspicious runtime telemetry because the inspected source does not disclose this collection or offer a user choice; no credential exfiltration or install-time attack was identified.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user signs up or joins an organization, or the web app’s hourly signup rollup runs.
Impact
Signup details are disclosed to the app operator’s Slack workspace without clear disclosure or user choice in the inspected source.
Mechanism
The app posts signup names, emails, domains, and organization names to Slack using SIGNUP_SLACK_BOT_TOKEN.
AI rationale
The web app automatically sends signup identities and organization details to an internal Slack channel, and periodically sends signup rollups. This is suspicious runtime telemetry because the inspected source does not disclose this collection or offer a user choice; no credential exfiltration or install-time attack was identified.
Evidence
src/web/app.ts
Network endpoints1
slack.com/api/chat.postMessage
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Signup and plan notifications include users’ names, email addresses, organization names, and domains, and are sent to Slack.
- The signup notification runs automatically after account creation; the source labels it a notification to the internal team.
- The web app starts an hourly signup rollup that sends recent signup details to Slack.
Evidence against
- The manifest has no install lifecycle scripts; the Slack behavior is in the web app, not an install hook.
- The package describes session streaming to Slack as a core feature, and uses a configured Slack bot token for notifications.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
NoLicenseWildcardDependency
Source & flagged code
7 flaggedscripts/perf-audit.tsView file
14import { mkdirSync, writeFileSync } from "fs";
L15: import { execSync } from "child_process";
L16: import { join } from "path";
High
Child Process
Package source references child process execution.
scripts/perf-audit.tsView on unpkg · L1433console.log(" Building CSS and starting local server ...");
L34: execSync("npx bun x tailwindcss -i src/web/styles/input.css -o src/web/styles/output.css --minify", { stdio: "pipe" });
L35:
L36: const port = await freePort();
L37: url = `http://localhost:${port}`;
L38:
L39: const proc = Bun.spawn(["bun", "run", "src/web/serve.ts"], {
L40: env: { ...process.env, WEB_PORT: String(port), DATABASE_URL: process.env.DATABASE_URL ?? "postgres://polaris:polaris@localhost:5432/polaris" },
L41: stdout: "pipe",
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
scripts/perf-audit.tsView on unpkg · L3333console.log(" Building CSS and starting local server ...");
L34: execSync("npx bun x tailwindcss -i src/web/styles/input.css -o src/web/styles/output.css --minify", { stdio: "pipe" });
L35:
Findings
2 Critical5 High5 Medium5 Low
CriticalCredential Exfiltrationsrc/web/app.ts
CriticalPrevious Version Dangerous Deltasrc/daemon/daemon.ts
HighChild Processscripts/perf-audit.ts
HighShell
HighSame File Env Network Executionscripts/perf-audit.ts
HighRuntime Package Installscripts/perf-audit.ts
HighSemantic Analysis Limitedbin/polaris
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdocker/bridge-entrypoint.sh
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to @lightupai/polaris@0.0.175.
See all versions of @lightupai/polaris for other recorded verdicts.
- Review the evidence and your use of @lightupai/polaris@0.0.175 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.