registry / polymath-society / 0.2.4

polymath-society@0.2.4

Deterministic metrics from your local Claude Code / Codex agent logs — parallelism, flow, throughput, projects. Zero LLM, zero server, on-device.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 21 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

NoLicense

scanned 32 file(s), 14.3 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, chatgpt.com, claude.ai, claude.com, code.claude.com, cursor.com, docs.github.com, github.com, help.x.com, huggingface.co, json-schema.org, lu.ma, modal.com, polymathsociety.us, reactjs.org, todoist.com, www.calnewport.com, www.julian.com, www.linkedin.com, www.notion.so, www.w3.org, www.workatastartup.com, www.workfrom.co, www.youtube.com, x.com, zcbonfjgiorrxczyekxl.supabase.co

Source & flagged code

9 flagged

dist/index.jsView file

3025patternName = supabase_service_key severity = critical line = 3025 matchedText = var DEFA...d4";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L3025

3025patternName = supabase_service_key severity = critical line = 3025 matchedText = var DEFA...d4";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L3025

47} L48: if (text2 && text2.charCodeAt(0) === 65279) { L49: text2 = text2.slice(1); ... L143: /<task-notification>[\s\S]*?<\/task-notification>/g, L144: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L145: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L179: ]; L180: var anyRootOverridden = () => SOURCE_ROOT_ENV_VARS.some((v) => !!process.env[v]); L181: function resolveSourceRoot(envVar, ...defaultSegments) { ... L186: return null; L187: return path.join(os.homedir(), ...defaultSegments); L188: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L47

dist/pipeline/coding-aggregate.jsView file

Lines 1-34javascript

1import{createRequire as __cr}from'module';const require=__cr(import.meta.url);

3// ../../scripts/coding-aggregate.mts

4import { promises as fs2 } from "fs";

dist/pipeline/coding-build.jsView file

Lines 435-475javascript

435 }

436 return out;

437}

438var CURSOR_USER_QUERY_RE = /<user_query>\s*([\s\S]*?)\s*<\/user_query>/;

439function fileUriToPath

dist/cli.jsView file

3494patternName = supabase_service_key severity = critical line = 3494 matchedText = var DEFA...d4";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli.js

dist/cli.jsView on unpkg · L3494

58/<task-notification>[\s\S]*?<\/task-notification>/g, L59: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L60: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L78: function resolveSourceRoot(envVar, ...defaultSegments) { L79: const explicit = process.env[envVar]; L80: if (explicit) ... L83: return null; L84: return path.join(os.homedir(), ...defaultSegments); L85: } ... L188: try { L189: e = JSON.parse(line); L190: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L58

58Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L58: /<task-notification>[\s\S]*?<\/task-notification>/g, L59: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L60: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L78: function resolveSourceRoot(envVar, ...defaultSegments) { L79: const explicit = process.env[envVar]; L80: if (explicit) ... L83: return null; L84: return path.join(os.homedir(), ...defaultSegments); L85: } ... L188: try { L189: e = JSON.parse(line); L190: } catch {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/pipeline/coding-gap.jsView file

145// ../../lib/agents/shared/cliAdapter.ts L146: import { spawn } from "child_process"; L147: import { promises as fs2 } from "fs"; ... L10094: availableTools = void 0, L10095: message = `Model tried to call unavailable tool '${toolName}'. ${availableTools === void 0 ? "No tools are available." : `Available tools: ${availableTools.join(", ")}.`}` L10096: }) { ... L11806: var _a17, _b, _c; L11807: return (_c = (_b = (_a17 = this.config).buildRequestUrl) == null ? void 0 : _b.call(_a17, this.config.baseURL, isStreaming)) != null ? _c : `${this.config.baseURL}/messages`; L11808: } ... L15586: try { L15587: const p = JSON.parse(readFileSync(path8.join(process.cwd(), ".data", "profile.json"), "utf-8")); L15588: const e = p?.preferredEngine;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/pipeline/coding-gap.jsView on unpkg · L145

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code