registry / @humanbased/crosscheck / 1.0.0

@humanbased/crosscheck@1.0.0

AI code review pipeline that turns agent-written PRs into merge-ready patches

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 686 KB of source, external domains: api.github.com, claude.ai, github.com, openai.com, smee.io

Source & flagged code

3 flagged

dist/config/loader.jsView file

Lines 1-21javascript

1import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';

2import { execSync } from 'child_process';

3import { createInterface } from 'readline';

High

Child Process

Package source references child process execution.

dist/config/loader.jsView on unpkg · L1

4import { resolve, join, dirname } from 'path';

5import { homedir } from 'os';

6import { randomBytes } from 'crypto';

7import yaml from 'js-yaml';

8import { ConfigSchema } from './schema.js';

9import { listUserOrgs } from '../github/client.js';

10const CONFIG_FILENAME = 'crosscheck.config.yml';

11function findConfigFile() {

12 // Home is searched first: crosscheck is a user-level tool (it reviews PRs across

13 // all the user's repos/orgs), so ~/.crosscheck/config.yml is the natural source of

14 // truth. A cwd file is treated as a deliberate per-project override.

15 const candidates = [

16 join(homedir(), '.crosscheck', 'config.yml'),

17 resolve(process.cwd(), CONFIG_FILENAME),

18 resolve(process.cwd(), '.crosscheck.yml'),

19 ];

20 return candidates.find(existsSync) ?? null;

21}

dist/reviewers/conflict-resolve.jsView file

Lines 1-23javascript

1import { execSync } from 'child_process';

2import { readFileSync } from 'fs';

3import { join } from 'path';

4import { execa } from 'execa';

5import { applyEdit } from './fix.js';

dist/commands/init.jsView file

Lines 153-183javascript

153 // author_routes is intentionally not auto-patched: `crosscheck onboard` writes it

154 // only when the user picks a single authorVendor, since cross-vendor + both

155 // enabled bypasses the route (see detector.ts).

156 const existing = loadConfig(resolveConfigPath(configPath) ?? dest);

157 const login = detectGitHubLogin();

Source & flagged code

3 flagged · loading source

dist/config/loader.jsView file

1import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs'; L2: import { execSync } from 'child_process'; L3: import { createInterface } from 'readline';

High

Child Process

Package source references child process execution.

dist/config/loader.jsView on unpkg · L1

dist/reviewers/conflict-resolve.jsView file

3import { join } from 'path'; L4: import { execa } from 'execa'; L5: import { applyEdit } from './fix.js';

High

Shell

Package source references shell execution.

dist/reviewers/conflict-resolve.jsView on unpkg · L3

dist/commands/init.jsView file

173try { L174: execSync('smee --version', { stdio: 'ignore' }); L175: } ... L177: console.log(chalk.dim('Tip: install smee-client for reliable webhook delivery (events queued while offline):')); L178: console.log(chalk.dim(' npm install -g smee-client')); L179: console.log(chalk.dim(' Then set tunnel: backend: smee in your config.\n'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L173

Findings

3 High3 Medium5 Low

HighChild Processdist/config/loader.js

HighShelldist/reviewers/conflict-resolve.js

HighRuntime Package Installdist/commands/init.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/config/loader.jsView file

Lines 1-21javascript

1import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';

2import { execSync } from 'child_process';

3import { createInterface } from 'readline';

High

Child Process

Package source references child process execution.

dist/config/loader.jsView on unpkg · L1

4import { resolve, join, dirname } from 'path';

5import { homedir } from 'os';

6import { randomBytes } from 'crypto';

7import yaml from 'js-yaml';

8import { ConfigSchema } from './schema.js';

9import { listUserOrgs } from '../github/client.js';

10const CONFIG_FILENAME = 'crosscheck.config.yml';

11function findConfigFile() {

12 // Home is searched first: crosscheck is a user-level tool (it reviews PRs across

13 // all the user's repos/orgs), so ~/.crosscheck/config.yml is the natural source of

14 // truth. A cwd file is treated as a deliberate per-project override.

15 const candidates = [

16 join(homedir(), '.crosscheck', 'config.yml'),

17 resolve(process.cwd(), CONFIG_FILENAME),

18 resolve(process.cwd(), '.crosscheck.yml'),

19 ];

20 return candidates.find(existsSync) ?? null;

21}

dist/reviewers/conflict-resolve.jsView file

Lines 1-23javascript

1import { execSync } from 'child_process';

2import { readFileSync } from 'fs';

3import { join } from 'path';

4import { execa } from 'execa';

5import { applyEdit } from './fix.js';

dist/commands/init.jsView file

Lines 153-183javascript

153 // author_routes is intentionally not auto-patched: `crosscheck onboard` writes it

154 // only when the user picks a single authorVendor, since cross-vendor + both

155 // enabled bypasses the route (see detector.ts).

156 const existing = loadConfig(resolveConfigPath(configPath) ?? dest);

157 const login = detectGitHubLogin();