polymath-society@0.2.12: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

polymath-society@0.2.12: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

10 flagged · loading source

dist/index.jsView file

3055patternName = supabase_service_key severity = critical line = 3055 matchedText = var DEFA...d4";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L3055

3055patternName = supabase_service_key severity = critical line = 3055 matchedText = var DEFA...d4";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L3055

47} L48: if (text2 && text2.charCodeAt(0) === 65279) { L49: text2 = text2.slice(1); ... L143: /<task-notification>[\s\S]*?<\/task-notification>/g, L144: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L145: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L179: ]; L180: var anyRootOverridden = () => SOURCE_ROOT_ENV_VARS.some((v) => !!process.env[v]); L181: function resolveSourceRoot(envVar, ...defaultSegments) { ... L186: return null; L187: return path.join(os.homedir(), ...defaultSegments); L188: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L47

dist/pipeline/coding-aggregate.jsView file

14// ../../lib/agents/shared/tools.ts L15: import { execFile } from "child_process"; L16: import { promisify } from "util";

High

Child Process

Package source references child process execution.

dist/pipeline/coding-aggregate.jsView on unpkg · L14

dist/pipeline/coding-build.jsView file

455try { L456: mod = await import(NODE_SQLITE); L457: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pipeline/coding-build.jsView on unpkg · L455

dist/cli.jsView file

4093patternName = supabase_service_key severity = critical line = 4093 matchedText = var DEFA...d4";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli.js

dist/cli.jsView on unpkg · L4093

41"/Applications/Polymath.[redacted]/.data", L42: path.join(os.homedir(), "Applications", "Polymath.app", "Contents", "Resources", "standalone", ".data") L43: ]; ... L46: } L47: function resolveDataRoot(env = process.env, cwd = process.cwd(), appData = electronAppData) { L48: const fromEnv = env.POLYMATH_DATA_DIR; ... L85: /<task-notification>[\s\S]*?<\/task-notification>/g, L86: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L87: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L215: try { L216: e = JSON.parse(line); L217: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L41

41Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L41: "/Applications/Polymath.[redacted]/.data", L42: path.join(os.homedir(), "Applications", "Polymath.app", "Contents", "Resources", "standalone", ".data") L43: ]; ... L46: } L47: function resolveDataRoot(env = process.env, cwd = process.cwd(), appData = electronAppData) { L48: const fromEnv = env.POLYMATH_DATA_DIR; ... L85: /<task-notification>[\s\S]*?<\/task-notification>/g, L86: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L87: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L215: try { L216: e = JSON.parse(line); L217: } catch {

dist/pipeline/coding-gap.jsView file

144// ../../lib/agents/shared/cliAdapter.ts L145: import { spawn } from "child_process"; L146: import { promises as fs2 } from "fs"; ... L10114: availableTools = void 0, L10115: message = `Model tried to call unavailable tool '${toolName}'. ${availableTools === void 0 ? "No tools are available." : `Available tools: ${availableTools.join(", ")}.`}` L10116: }) { ... L11826: var _a17, _b, _c; L11827: return (_c = (_b = (_a17 = this.config).buildRequestUrl) == null ? void 0 : _b.call(_a17, this.config.baseURL, isStreaming)) != null ? _c : `${this.config.baseURL}/messages`; L11828: } ... L15606: try { L15607: const p = JSON.parse(readFileSync(path8.join(process.cwd(), ".data", "profile.json"), "utf-8")); L15608: const e = p?.preferredEngine;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/pipeline/coding-gap.jsView on unpkg · L144

dist/engine/exp-allfacets.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = polymath-society@0.2.11 matchedIdentity = npm:cG9seW1hdGgtc29jaWV0eQ:0.2.11 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/engine/exp-allfacets.jsView on unpkg

Source & flagged code

10 flagged

dist/index.jsView file

3055patternName = supabase_service_key severity = critical line = 3055 matchedText = var DEFA...d4";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L3055

3055patternName = supabase_service_key severity = critical line = 3055 matchedText = var DEFA...d4";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L3055

47} L48: if (text2 && text2.charCodeAt(0) === 65279) { L49: text2 = text2.slice(1); ... L143: /<task-notification>[\s\S]*?<\/task-notification>/g, L144: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L145: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L179: ]; L180: var anyRootOverridden = () => SOURCE_ROOT_ENV_VARS.some((v) => !!process.env[v]); L181: function resolveSourceRoot(envVar, ...defaultSegments) { ... L186: return null; L187: return path.join(os.homedir(), ...defaultSegments); L188: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L47

dist/pipeline/coding-aggregate.jsView file

Lines 1-34javascript

1import{createRequire as __cr}from'module';const require=__cr(import.meta.url);

2

3// ../../scripts/coding-aggregate.mts

4import { promises as fs2 } from

dist/pipeline/coding-build.jsView file

Lines 435-475javascript

435 }

436 return out;

437}

438var CURSOR_USER_QUERY_RE = /<user_query>\s*([\s\S]*?)\s*<\/user_query>/;

439function fileUriToPath

dist/cli.jsView file

4093patternName = supabase_service_key severity = critical line = 4093 matchedText = var DEFA...d4";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli.js

dist/cli.jsView on unpkg · L4093

41"/Applications/Polymath.[redacted]/.data", L42: path.join(os.homedir(), "Applications", "Polymath.app", "Contents", "Resources", "standalone", ".data") L43: ]; ... L46: } L47: function resolveDataRoot(env = process.env, cwd = process.cwd(), appData = electronAppData) { L48: const fromEnv = env.POLYMATH_DATA_DIR; ... L85: /<task-notification>[\s\S]*?<\/task-notification>/g, L86: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L87: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L215: try { L216: e = JSON.parse(line); L217: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L41

41Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L41: "/Applications/Polymath.[redacted]/.data", L42: path.join(os.homedir(), "Applications", "Polymath.app", "Contents", "Resources", "standalone", ".data") L43: ]; ... L46: } L47: function resolveDataRoot(env = process.env, cwd = process.cwd(), appData = electronAppData) { L48: const fromEnv = env.POLYMATH_DATA_DIR; ... L85: /<task-notification>[\s\S]*?<\/task-notification>/g, L86: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L87: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L215: try { L216: e = JSON.parse(line); L217: } catch {

dist/pipeline/coding-gap.jsView file

144// ../../lib/agents/shared/cliAdapter.ts L145: import { spawn } from "child_process"; L146: import { promises as fs2 } from "fs"; ... L10114: availableTools = void 0, L10115: message = `Model tried to call unavailable tool '${toolName}'. ${availableTools === void 0 ? "No tools are available." : `Available tools: ${availableTools.join(", ")}.`}` L10116: }) { ... L11826: var _a17, _b, _c; L11827: return (_c = (_b = (_a17 = this.config).buildRequestUrl) == null ? void 0 : _b.call(_a17, this.config.baseURL, isStreaming)) != null ? _c : `${this.config.baseURL}/messages`; L11828: } ... L15606: try { L15607: const p = JSON.parse(readFileSync(path8.join(process.cwd(), ".data", "profile.json"), "utf-8")); L15608: const e = p?.preferredEngine;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/pipeline/coding-gap.jsView on unpkg · L144

dist/engine/exp-allfacets.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = polymath-society@0.2.11 matchedIdentity = npm:cG9seW1hdGgtc29jaWV0eQ:0.2.11 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/engine/exp-allfacets.jsView on unpkg