registry / twapfetch / 1.0.0

twapfetch@1.0.0

Simple Polymarket RTDS client for Chainlink TWAP prices (30s / 60s)

AI Security Review

scanned 4d ago · by lpm-firewall-ai

No malicious attack surface confirmed. The package performs user-invoked WebSocket price streaming only.

Static reason

No blocking static signals were detected.

Trigger

Consumer calls TwapClient.connect() or fetchTwapOnce().

Impact

Receives requested TWAP price data; no local mutation or exfiltration observed.

Mechanism

WebSocket subscription to Polymarket RTDS price topics

Rationale

Source inspection shows a narrowly scoped, user-invoked Polymarket WebSocket client. No install-time execution or concrete harmful behavior was found.

Evidence

package.jsonsrc/index.jssrc/index.d.tsREADME.md

Network endpoints1

wss://ws-live-data.polymarket.com

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install lifecycle hook; prepublishOnly only checks src/index.js exists.
src/index.js only opens a WebSocket after consumer calls connect() or fetchTwapOnce().
No filesystem writes, process/env access, shell execution, eval, or dynamic loading found.
Runtime messages are parsed as JSON and emitted as price updates; no received code is executed.

Behavioral surface

Source

WebSocket

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 9.14 KB of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

2 Low

LowNon Install Lifecycle Scripts

LowScripts Present