polymath-society@0.2.9: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

polymath-society@0.2.9: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

10 flagged · loading source

dist/index.jsView file

3034patternName = supabase_service_key severity = critical line = 3034 matchedText = var DEFA...d4";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/index.jsView on unpkg · L3034

3034patternName = supabase_service_key severity = critical line = 3034 matchedText = var DEFA...d4";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/index.js

dist/index.jsView on unpkg · L3034

47} L48: if (text2 && text2.charCodeAt(0) === 65279) { L49: text2 = text2.slice(1); ... L143: /<task-notification>[\s\S]*?<\/task-notification>/g, L144: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L145: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L179: ]; L180: var anyRootOverridden = () => SOURCE_ROOT_ENV_VARS.some((v) => !!process.env[v]); L181: function resolveSourceRoot(envVar, ...defaultSegments) { ... L186: return null; L187: return path.join(os.homedir(), ...defaultSegments); L188: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L47

dist/pipeline/coding-aggregate.jsView file

14// ../../lib/agents/shared/tools.ts L15: import { execFile } from "child_process"; L16: import { promisify } from "util";

High

Child Process

Package source references child process execution.

dist/pipeline/coding-aggregate.jsView on unpkg · L14

dist/pipeline/coding-build.jsView file

455try { L456: mod = await import(NODE_SQLITE); L457: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pipeline/coding-build.jsView on unpkg · L455

dist/cli.jsView file

4051patternName = supabase_service_key severity = critical line = 4051 matchedText = var DEFA...d4";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/cli.js

dist/cli.jsView on unpkg · L4051

41"/Applications/Polymath.[redacted]/.data", L42: path.join(os.homedir(), "Applications", "Polymath.app", "Contents", "Resources", "standalone", ".data") L43: ]; ... L46: } L47: function resolveDataRoot(env = process.env, cwd = process.cwd(), appData = electronAppData) { L48: const fromEnv = env.POLYMATH_DATA_DIR; ... L85: /<task-notification>[\s\S]*?<\/task-notification>/g, L86: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L87: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L215: try { L216: e = JSON.parse(line); L217: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L41

41Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L41: "/Applications/Polymath.[redacted]/.data", L42: path.join(os.homedir(), "Applications", "Polymath.app", "Contents", "Resources", "standalone", ".data") L43: ]; ... L46: } L47: function resolveDataRoot(env = process.env, cwd = process.cwd(), appData = electronAppData) { L48: const fromEnv = env.POLYMATH_DATA_DIR; ... L85: /<task-notification>[\s\S]*?<\/task-notification>/g, L86: /<local-command-stdout>[\s\S]*?<\/local-command-stdout>/g, L87: /<local-command-caveat>[\s\S]*?<\/local-command-caveat>/g, ... L215: try { L216: e = JSON.parse(line); L217: } catch {

dist/pipeline/coding-gap.jsView file

144// ../../lib/agents/shared/cliAdapter.ts L145: import { spawn } from "child_process"; L146: import { promises as fs2 } from "fs"; ... L10093: availableTools = void 0, L10094: message = `Model tried to call unavailable tool '${toolName}'. ${availableTools === void 0 ? "No tools are available." : `Available tools: ${availableTools.join(", ")}.`}` L10095: }) { ... L11805: var _a17, _b, _c; L11806: return (_c = (_b = (_a17 = this.config).buildRequestUrl) == null ? void 0 : _b.call(_a17, this.config.baseURL, isStreaming)) != null ? _c : `${this.config.baseURL}/messages`; L11807: } ... L15585: try { L15586: const p = JSON.parse(readFileSync(path8.join(process.cwd(), ".data", "profile.json"), "utf-8")); L15587: const e = p?.preferredEngine;

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/pipeline/coding-gap.jsView on unpkg · L144

dist/pipeline/coding-coaching.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = polymath-society@0.2.4 matchedIdentity = npm:cG9seW1hdGgtc29jaWV0eQ:0.2.4 similarity = 0.813 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/pipeline/coding-coaching.jsView on unpkg