registry / @lcv-ideas-software/cross-review / 4.5.9

@lcv-ideas-software/cross-review@4.5.9

API-first MCP server for multi-model cross-review with unanimous convergence gates.

AI Security Review

scanned 1h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network use is the package’s explicit multi-provider review function, and state writes are confined to configured package data paths.

Static reason

One or more suspicious static signals were detected.

Trigger

User explicitly runs the MCP server or invokes review tools that select a provider.

Impact

Sends user-supplied review content to operator-configured AI providers; writes review state and first-party caller tokens locally.

Mechanism

MCP review orchestration, provider API calls, and local session/token persistence.

Rationale

Direct inspection shows an explicitly invoked MCP multi-model review service with expected provider networking and package-owned local persistence. No install-time execution, credential harvesting/exfiltration path, remote payload execution, destructive behavior, or foreign AI-agent configuration mutation was found.

Evidence

package.jsondist/src/mcp/server.jsdist/src/core/config.jsdist/src/core/caller-tokens.jsdist/src/core/session-store.jsdist/src/dashboard/server.jsdist/src/peers/deepseek.jsdist/src/peers/grok.jsdist/src/peers/perplexity.jsdist/scripts/smoke.jsdata/host-tokens.jsondata/config.json

Network endpoints3

api.deepseek.comapi.perplexity.aiapi.x.ai/v1

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for warning

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare hook.
`dist/src/mcp/server.js` starts only under its main-module guard.
`dist/src/peers/*.js` uses configured API keys for declared model-provider clients.
`dist/src/dashboard/server.js` binds its dashboard to `127.0.0.1`.
`dist/src/core/caller-tokens.js` creates package-owned caller tokens with mode `0600`.
No fixed credential matched in `dist/scripts/smoke.js`; the hint is test/config-related noise.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 1.92 MB of source, external domains: 127.0.0.1, ai.google.dev, api-docs.deepseek.com, api.deepseek.com, api.perplexity.ai, api.x.ai, cross-review.lcv.dev, developers.openai.com, docs.anthropic.com, docs.perplexity.ai, docs.x.ai, github.com, platform.claude.com, platform.openai.com, registry.npmjs.org

Source & flagged code

4 flagged

dist/scripts/smoke.jsView file

Lines 7149-7191javascript

7149 console.log("[smoke] agent_instruction_rename_history_test: PASS");

7150}

7151{

7152 const pkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), "package.json"), "utf8"));

7153 const script = String(pkg.scripts?.["release:verify-registry"] ?? "");

7154 assert.ok(script.includes("verify-registry-dist.mjs"), "v4.0.5 / AUDIT-6: package.json must expose release:verify-registry.");

7155 const verifyScript = fs.readFileSync(path.join(process.cwd(), "scripts", "verify-registry-dist.mjs"), "utf8");

7156 assert.ok(!verifyScript.includes("node:child_process"), "v4.0.6 / F1: verify-registry-dist.mjs must not spawn npm/npm.cmd; Windows Node hardening rejects npm.cmd spawn.");

7157 assert.ok(verifyScript.includes("https://registry.npmjs.org") && verifyScript.includes("fetch("), "v4.0.6 / F1: verify-registry-dist.mjs must query npm registry metadata directly.");

7158 assert.ok(verifyScript.includes("AbortSignal.timeout(") && verifyScript.includes("FETCH_TIMEOUT_MS"), "v4.0.7 / F2: verify-registry-dist.mjs must bound the npm registry fetch with an explicit AbortSignal.timeout so a slow registry surfaces as a deterministic abort instead of hanging the workflow.");

7159 assert.ok(!verifyScript.includes("readFileSync") &&

7160 !verifyScript.includes("readFile(") &&

7161 verifyScript.includes("npm_package_name") &&

7162 verifyScript.includes("npm_package_version"), "v4.0.8 / F3: verify-registry-dist.mjs must not read package.json from disk; PACKAGE_NAME/PACKAGE_VERSION come from env (or npm-script-injected npm_package_name/version). Removing the file-data → fetch flow kills the recurring js/file-access-to-http CodeQL false positive at the source.");

7163 // v4.1.0 / F4: redactPrivateKeyBlocks must handle UNTERMINATED -----BEGIN

7164 // PRIVATE KEY----- blocks by redacting from BEGIN to end-of-string. Pre-

7165 // v4.1.0 leaked partial keys to events.ndjson when logs were truncated

7166 // mid-key. Empirical regression test:

7167 {

7168 const { redact } = await import("../src/security/redact.js");

7169 const truncatedKey = `error: -----BEGIN PRIVATE KEY-----\nMIIBVQIBADANBgkqhkiG9w0BAQEF...[TRUNCATED`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scripts/smoke.jsView on unpkg · L7169

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7169

7170 const redacted = redact(truncatedKey);

7171 assert.ok(redacted.includes("[REDACTED]"), "v4.1.0 / F4: redact() must emit [REDACTED] for unterminated -----BEGIN PRIVATE KEY----- blocks.");

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7171

7172 assert.ok(!redacted.includes("MIIBVQIBADANBgkqhkiG9w0BAQEF"), "v4.1.0 / F4: redact() must NOT leak the partial key body when the BEGIN marker has no matching END.");

7173 assert.equal(redact("just a normal log line"), "just a normal log line", "v4.1.0 / F4: redact() must be passthrough when no PRIVATE KEY markers are present.");

7174 console.log("[smoke] redact_unterminated_private_key_test: PASS");

7175 }

7176 // v4.1.0 / F5: writeJson + cache-manifest writeJsonAtomic must be

7177 // async AND no source file under src/ may contain the

7178 // `while (Date.now() - start < wait)` CPU-burning busy-wait pattern.

7179 // Pre-v4.1.0 this pattern blocked the event loop for up to 310 ms

7180 // under Windows AV stress. Codex R1 NEEDS_EVIDENCE catch on session

7181 // 059b0093 asked for repo-wide grep (the original pin only covered

7182 // session-store.ts and missed cache-manifest.ts:47).

7183 {

7184 const storeSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "session-store.ts"), "utf8");

7185 assert.ok(/async\s+function\s+writeJson\b/.test(storeSrc), "v4.1.0 / F5: writeJson must be declared `async function writeJson` in src/core/session-store.ts.");

7186 assert.ok(/new\s+Promise[\s\S]{0,80}?setTimeout/.test(storeSrc), "v4.1.0 / F5: writeJson must use a Promise-based async delay (`new Promise(r => setTimeout(r, wait))`) for retry backoff so the event loop remains responsive.");

7187 const cacheManifestSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "cache-manifest.ts"), "utf8");

7188 assert.ok(/async\s+function\s+writeJsonAtomic\b/.test(cacheManifestSrc), "v4.1.0 / F5: writeJsonAtomic in cache-manifest.ts must be `async function writeJsonAtomic`.");

7189 // Repo-wide invariant: scan every .ts under src/ for executable

7190 // busy-wait patterns. Strip block comments so the pin only checks

7191 // executable code (comments may reference the removed pattern).

CHANGELOG.mdView file

Lines 1208-1248markdown

1208### Fixed

1209

1210- **F1 — Session-lock TOCTOU race (multi-process).** Pre-v4.1.0

1211 acquired `<session_dir>/.lock` by creating the file empty and then

1212 writing PID metadata in a separate syscall. Across multiple host

1213 processes sharing the same `data_dir`, a second process could

1214 observe the empty lock between the two syscalls, fail to JSON-parse

1215 it, remove it, create its own, and enter the critical section in

1216 parallel with the first holder — corrupting `meta.json`

Source & flagged code

4 flagged · loading source

dist/scripts/smoke.jsView file

7169patternName = private_key_rsa severity = critical line = 7169 matchedText = const tr...ED`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scripts/smoke.jsView on unpkg · L7169

7169patternName = private_key_rsa severity = critical line = 7169 matchedText = const tr...ED`;

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7169

7171patternName = private_key_rsa severity = critical line = 7171 matchedText = assert.o....");

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7171

CHANGELOG.mdView file

1228patternName = private_key_rsa severity = critical line = 1228 matchedText = `-----BE...hing

Critical

Secret Pattern

RSA private key in CHANGELOG.md

CHANGELOG.mdView on unpkg · L1228

Findings

4 Critical2 Medium4 Low

CriticalCritical Secretdist/scripts/smoke.js

CriticalSecret PatternCHANGELOG.md

CriticalSecret Patterndist/scripts/smoke.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

72%Warn

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

AuthorLCV Ideas & Software

Maintainerslcv-leo

Version4.5.10

PublishedJul 12, 2026

LicenseApache-2.0

Dependencies8

Integrityverified

Package size906 KB

Files185

Keywordsmcpmodel-context-protocolcross-reviewmulti-agentopenaianthropicgeminideepseek

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/src/mcp/server.jstypes → ./dist/src/mcp/server.d.tsbin → cross-review, cross-review-dashboard

Runtimenode >=22

Artifact4.07 MB · 185 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: api-streaming-smoke, biome, biome:write, build +8

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

4 flagged

dist/scripts/smoke.jsView file

Lines 7149-7191javascript

7149 console.log("[smoke] agent_instruction_rename_history_test: PASS");

7150}

7151{

7152 const pkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), "package.json"), "utf8"));

7153 const script = String(pkg.scripts?.["release:verify-registry"] ?? "");

7154 assert.ok(script.includes("verify-registry-dist.mjs"), "v4.0.5 / AUDIT-6: package.json must expose release:verify-registry.");

7155 const verifyScript = fs.readFileSync(path.join(process.cwd(), "scripts", "verify-registry-dist.mjs"), "utf8");

7156 assert.ok(!verifyScript.includes("node:child_process"), "v4.0.6 / F1: verify-registry-dist.mjs must not spawn npm/npm.cmd; Windows Node hardening rejects npm.cmd spawn.");

7157 assert.ok(verifyScript.includes("https://registry.npmjs.org") && verifyScript.includes("fetch("), "v4.0.6 / F1: verify-registry-dist.mjs must query npm registry metadata directly.");

7159 assert.ok(!verifyScript.includes("readFileSync") &&

7160 !verifyScript.includes("readFile(") &&

7161 verifyScript.includes("npm_package_name") &&

7163 // v4.1.0 / F4: redactPrivateKeyBlocks must handle UNTERMINATED -----BEGIN

7164 // PRIVATE KEY----- blocks by redacting from BEGIN to end-of-string. Pre-

7165 // v4.1.0 leaked partial keys to events.ndjson when logs were truncated

7166 // mid-key. Empirical regression test:

7167 {

7168 const { redact } = await import("../src/security/redact.js");

7169 const truncatedKey = `error: -----BEGIN PRIVATE KEY-----\nMIIBVQIBADANBgkqhkiG9w0BAQEF...[TRUNCATED`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scripts/smoke.jsView on unpkg · L7169

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7169

7170 const redacted = redact(truncatedKey);

7171 assert.ok(redacted.includes("[REDACTED]"), "v4.1.0 / F4: redact() must emit [REDACTED] for unterminated -----BEGIN PRIVATE KEY----- blocks.");

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7171

7172 assert.ok(!redacted.includes("MIIBVQIBADANBgkqhkiG9w0BAQEF"), "v4.1.0 / F4: redact() must NOT leak the partial key body when the BEGIN marker has no matching END.");

7173 assert.equal(redact("just a normal log line"), "just a normal log line", "v4.1.0 / F4: redact() must be passthrough when no PRIVATE KEY markers are present.");

7174 console.log("[smoke] redact_unterminated_private_key_test: PASS");

7175 }

7176 // v4.1.0 / F5: writeJson + cache-manifest writeJsonAtomic must be

7177 // async AND no source file under src/ may contain the

7178 // `while (Date.now() - start < wait)` CPU-burning busy-wait pattern.

7179 // Pre-v4.1.0 this pattern blocked the event loop for up to 310 ms

7180 // under Windows AV stress. Codex R1 NEEDS_EVIDENCE catch on session

7181 // 059b0093 asked for repo-wide grep (the original pin only covered

7182 // session-store.ts and missed cache-manifest.ts:47).

7183 {

7184 const storeSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "session-store.ts"), "utf8");

7185 assert.ok(/async\s+function\s+writeJson\b/.test(storeSrc), "v4.1.0 / F5: writeJson must be declared `async function writeJson` in src/core/session-store.ts.");

7187 const cacheManifestSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "cache-manifest.ts"), "utf8");

7188 assert.ok(/async\s+function\s+writeJsonAtomic\b/.test(cacheManifestSrc), "v4.1.0 / F5: writeJsonAtomic in cache-manifest.ts must be `async function writeJsonAtomic`.");

7189 // Repo-wide invariant: scan every .ts under src/ for executable

7190 // busy-wait patterns. Strip block comments so the pin only checks

7191 // executable code (comments may reference the removed pattern).

CHANGELOG.mdView file

Lines 1208-1248markdown

1208### Fixed

1209

1210- **F1 — Session-lock TOCTOU race (multi-process).** Pre-v4.1.0

1211 acquired `<session_dir>/.lock` by creating the file empty and then

1212 writing PID metadata in a separate syscall. Across multiple host

1213 processes sharing the same `data_dir`, a second process could

1214 observe the empty lock between the two syscalls, fail to JSON-parse

1215 it, remove it, create its own, and enter the critical section in

1216 parallel with the first holder — corrupting `meta.json`