Loading npm security reports…

polymath-society@0.2.18: Suspicious npm security report (Warn) | LPM Firewall

registry / polymath-society / 0.2.18

polymath-society@0.2.18

Deterministic metrics from your local Claude Code / Codex agent logs — parallelism, flow, throughput, projects. Zero LLM, zero server, on-device.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 34 file(s), 16.1 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, chatgpt.com, claude.ai, claude.com, code.claude.com, cursor.com, docs.github.com, github.com, help.x.com, huggingface.co, json-schema.org, lu.ma, modal.com, polymathsociety.us, reactjs.org, registry.npmjs.org, todoist.com, www.calnewport.com, www.julian.com, www.linkedin.com, www.notion.so, www.w3.org, www.workatastartup.com, www.workfrom.co, www.youtube.com, x.com, zcbonfjgiorrxczyekxl.supabase.co

Source & flagged code

9 flagged

dist/index.jsView file

3063patternName = supabase_service_key severity = critical line = 3063 matchedText = var DEFA...d4";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L3063

3063patternName = supabase_service_key severity = critical line = 3063 matchedText = var DEFA...d4";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L3063

47} L48: if (text2 && text2.charCodeAt(0) === 65279) { L49: text2 = text2.slice(1); ... L143: /<task-notification>[\s\S]*?<\/task-notification>/g, L144: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L145: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L179: ]; L180: var anyRootOverridden = () => SOURCE_ROOT_ENV_VARS.some((v) => !!process.env[v]); L181: function resolveSourceRoot(envVar, ...defaultSegments) { ... L186: return null; L187: return path.join(os.homedir(), ...defaultSegments); L188: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L47

dist/pipeline/coding-aggregate.jsView file

Lines 1-34javascript

1import{createRequire as __cr}from'module';const require=__cr(import.meta.url);

3// ../../scripts/coding-aggregate.mts

4import { promises as fs2 } from

dist/pipeline/coding-build.jsView file

Lines 435-475javascript

435 }

436 return out;

437}

438var CURSOR_USER_QUERY_RE = /<user_query>\s*([\s\S]*?)\s*<\/user_query>/;

439function fileUriToPath

dist/cli.jsView file

4135patternName = supabase_service_key severity = critical line = 4135 matchedText = var DEFA...d4";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli.js

dist/cli.jsView on unpkg · L4135

41"/Applications/Polymath.[redacted]/.data", L42: path.join(os.homedir(), "Applications", "Polymath.app", "Contents", "Resources", "standalone", ".data") L43: ]; ... L46: } L47: function resolveDataRoot(env = process.env, cwd = process.cwd(), appData = electronAppData) { L48: const fromEnv = env.POLYMATH_DATA_DIR; ... L85: /<task-notification>[\s\S]*?<\/task-notification>/g, L86: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L87: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L215: try { L216: e = JSON.parse(line); L217: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L41

41Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L41: "/Applications/Polymath.[redacted]/.data", L42: path.join(os.homedir(), "Applications", "Polymath.app", "Contents", "Resources", "standalone", ".data") L43: ]; ... L46: } L47: function resolveDataRoot(env = process.env, cwd = process.cwd(), appData = electronAppData) { L48: const fromEnv = env.POLYMATH_DATA_DIR; ... L85: /<task-notification>[\s\S]*?<\/task-notification>/g, L86: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L87: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L215: try { L216: e = JSON.parse(line); L217: } catch {

dist/pipeline/coding-gap.jsView file

144// ../../lib/agents/shared/cliAdapter.ts L145: import { spawn } from "child_process"; L146: import { promises as fs2 } from "fs"; ... L10114: availableTools = void 0, L10115: message = `Model tried to call unavailable tool '${toolName}'. ${availableTools === void 0 ? "No tools are available." : `Available tools: ${availableTools.join(", ")}.`}` L10116: }) { ... L11826: var _a17, _b, _c; L11827: return (_c = (_b = (_a17 = this.config).buildRequestUrl) == null ? void 0 : _b.call(_a17, this.config.baseURL, isStreaming)) != null ? _c : `${this.config.baseURL}/messages`; L11828: } ... L15606: try { L15607: const p = JSON.parse(readFileSync(path8.join(process.cwd(), ".data", "profile.json"), "utf-8")); L15608: const e = p?.preferredEngine;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/pipeline/coding-gap.jsView on unpkg · L144

Source & flagged code

9 flagged

dist/index.jsView file

3063patternName = supabase_service_key severity = critical line = 3063 matchedText = var DEFA...d4";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L3063

3063patternName = supabase_service_key severity = critical line = 3063 matchedText = var DEFA...d4";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L3063

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L47

dist/pipeline/coding-aggregate.jsView file

Lines 1-34javascript

1import{createRequire as __cr}from'module';const require=__cr(import.meta.url);

3// ../../scripts/coding-aggregate.mts

4import { promises as fs2 } from

dist/pipeline/coding-build.jsView file

Lines 435-475javascript

435 }

436 return out;

437}

438var CURSOR_USER_QUERY_RE = /<user_query>\s*([\s\S]*?)\s*<\/user_query>/;

439function fileUriToPath

dist/cli.jsView file

4135patternName = supabase_service_key severity = critical line = 4135 matchedText = var DEFA...d4";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli.js

dist/cli.jsView on unpkg · L4135

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L41

dist/pipeline/coding-gap.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/pipeline/coding-gap.jsView on unpkg · L144

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code