@lightupai/polaris@0.0.96
⚠ Under reviewRecord and stream Claude Code sessions to Slack. Like Gong for AI coding — capture every prompt, response, and tool call. Multiplayer collaboration across AI coding agents.
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest has no install lifecycle hooks, and the flagged audit script is an explicit performance audit. The CLI implementation is unreadable as source, leaving a material runtime behavior gap; the evidence does not establish an attack or support a clean verdict.
Decision evidence
public snapshot- package.json exposes a CLI at bin/polaris, which the wrapper directs to src/cli/cli.ts.
- The wrapper runs the CLI implementation, but src/cli/cli.ts is a binary/non-UTF-8 file and could not be reviewed as source.
- The flagged performance audit uses a supplied URL or the package’s own app URL and is not an install hook.
- package.json declares no preinstall, install, or postinstall hook.
- Readable Slack bridge code routes project events through an org’s Slack integration.
Source & flagged code
6 flaggedPackage source references child process execution.
scripts/perf-audit.tsView on unpkg · L14A single source file combines environment access, network access, and code or shell execution; review context before blocking.
scripts/perf-audit.tsView on unpkg · L33Findings
Affected versions and remediation
This report applies to @lightupai/polaris@0.0.96.
See all versions of @lightupai/polaris for other recorded verdicts.
- Review the evidence and your use of @lightupai/polaris@0.0.96 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.