registry / @lcv-ideas-software/cross-review / 4.5.3

@lcv-ideas-software/cross-review@4.5.3

API-first MCP server for multi-model cross-review with unanimous convergence gates.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. On explicit CLI/MCP-server launch, the package creates package-owned capability tokens and persists review state under its configured data directory. It can submit user-supplied review material to configured first-party model-provider APIs. No install-time or foreign control-surface mutation is established.

Static reason

One or more suspicious static signals were detected.

Trigger

User launches `cross-review` or invokes its MCP tools.

Impact

Review content may leave the host through configured provider APIs; local MCP capability-token and session files are created.

Mechanism

MCP multi-model review service with local token/session persistence and provider API requests.

Rationale

Source inspection found no npm lifecycle execution, payload staging, foreign agent-config writes, or arbitrary command execution. The package still creates MCP capability state and transmits review requests to model providers during normal runtime, so a warn is appropriate for this capability-bearing MCP service.

Evidence

package.jsondist/src/mcp/server.jsdist/src/core/caller-tokens.jsdist/src/core/session-store.jsdist/src/observability/logger.jsdist/src/peers/deepseek.js<data_dir>/host-tokens.json<data_dir>/sessions/<data_dir>/logs/

Network endpoints3

api.deepseek.comapi.x.ai/v1api.perplexity.ai

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/src/mcp/server.js` initializes caller tokens when the CLI MCP server starts.
`dist/src/core/caller-tokens.js` creates `<data_dir>/host-tokens.json` and supports operator-triggered token rotation.
The runtime sends review content to configured model-provider APIs, including DeepSeek, xAI, and Perplexity.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
No eval, VM, dynamic payload loader, shell execution, or foreign AI-agent config mutation was found.
`caller-tokens.js` uses `spawnSync` only for a time-bounded parent-process snapshot.
Session, log, cache, and token writes are scoped to the configured `data_dir`.
The scanner's secret hit is in `dist/scripts/smoke.js` test coverage, not an embedded credential.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 45 file(s), 1.48 MB of source, external domains: 127.0.0.1, ai.google.dev, api-docs.deepseek.com, api.deepseek.com, api.perplexity.ai, api.x.ai, cross-review.lcv.dev, developers.openai.com, docs.anthropic.com, docs.perplexity.ai, docs.x.ai, github.com, platform.claude.com, platform.openai.com, registry.npmjs.org

Source & flagged code

4 flagged

dist/scripts/smoke.jsView file

Lines 7121-7163javascript

7121 console.log("[smoke] agent_instruction_rename_history_test: PASS");

7122}

7123{

7124 const pkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), "package.json"), "utf8"));

7125 const script = String(pkg.scripts?.["release:verify-registry"] ?? "");

7126 assert.ok(script.includes("verify-registry-dist.mjs"), "v4.0.5 / AUDIT-6: package.json must expose release:verify-registry.");

7127 const verifyScript = fs.readFileSync(path.join(process.cwd(), "scripts", "verify-registry-dist.mjs"), "utf8");

7128 assert.ok(!verifyScript.includes("node:child_process"), "v4.0.6 / F1: verify-registry-dist.mjs must not spawn npm/npm.cmd; Windows Node hardening rejects npm.cmd spawn.");

7129 assert.ok(verifyScript.includes("https://registry.npmjs.org") && verifyScript.includes("fetch("), "v4.0.6 / F1: verify-registry-dist.mjs must query npm registry metadata directly.");

7130 assert.ok(verifyScript.includes("AbortSignal.timeout(") && verifyScript.includes("FETCH_TIMEOUT_MS"), "v4.0.7 / F2: verify-registry-dist.mjs must bound the npm registry fetch with an explicit AbortSignal.timeout so a slow registry surfaces as a deterministic abort instead of hanging the workflow.");

7131 assert.ok(!verifyScript.includes("readFileSync") &&

7132 !verifyScript.includes("readFile(") &&

7133 verifyScript.includes("npm_package_name") &&

7134 verifyScript.includes("npm_package_version"), "v4.0.8 / F3: verify-registry-dist.mjs must not read package.json from disk; PACKAGE_NAME/PACKAGE_VERSION come from env (or npm-script-injected npm_package_name/version). Removing the file-data → fetch flow kills the recurring js/file-access-to-http CodeQL false positive at the source.");

7135 // v4.1.0 / F4: redactPrivateKeyBlocks must handle UNTERMINATED -----BEGIN

7136 // PRIVATE KEY----- blocks by redacting from BEGIN to end-of-string. Pre-

7137 // v4.1.0 leaked partial keys to events.ndjson when logs were truncated

7138 // mid-key. Empirical regression test:

7139 {

7140 const { redact } = await import("../src/security/redact.js");

7141 const truncatedKey = `error: -----BEGIN PRIVATE KEY-----\nMIIBVQIBADANBgkqhkiG9w0BAQEF...[TRUNCATED`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scripts/smoke.jsView on unpkg · L7141

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7141

7142 const redacted = redact(truncatedKey);

7143 assert.ok(redacted.includes("[REDACTED]"), "v4.1.0 / F4: redact() must emit [REDACTED] for unterminated -----BEGIN PRIVATE KEY----- blocks.");

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7143

7144 assert.ok(!redacted.includes("MIIBVQIBADANBgkqhkiG9w0BAQEF"), "v4.1.0 / F4: redact() must NOT leak the partial key body when the BEGIN marker has no matching END.");

7145 assert.equal(redact("just a normal log line"), "just a normal log line", "v4.1.0 / F4: redact() must be passthrough when no PRIVATE KEY markers are present.");

7146 console.log("[smoke] redact_unterminated_private_key_test: PASS");

7147 }

7148 // v4.1.0 / F5: writeJson + cache-manifest writeJsonAtomic must be

7149 // async AND no source file under src/ may contain the

7150 // `while (Date.now() - start < wait)` CPU-burning busy-wait pattern.

7151 // Pre-v4.1.0 this pattern blocked the event loop for up to 310 ms

7152 // under Windows AV stress. Codex R1 NEEDS_EVIDENCE catch on session

7153 // 059b0093 asked for repo-wide grep (the original pin only covered

7154 // session-store.ts and missed cache-manifest.ts:47).

7155 {

7156 const storeSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "session-store.ts"), "utf8");

7157 assert.ok(/async\s+function\s+writeJson\b/.test(storeSrc), "v4.1.0 / F5: writeJson must be declared `async function writeJson` in src/core/session-store.ts.");

7158 assert.ok(/new\s+Promise[\s\S]{0,80}?setTimeout/.test(storeSrc), "v4.1.0 / F5: writeJson must use a Promise-based async delay (`new Promise(r => setTimeout(r, wait))`) for retry backoff so the event loop remains responsive.");

7159 const cacheManifestSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "cache-manifest.ts"), "utf8");

7160 assert.ok(/async\s+function\s+writeJsonAtomic\b/.test(cacheManifestSrc), "v4.1.0 / F5: writeJsonAtomic in cache-manifest.ts must be `async function writeJsonAtomic`.");

7161 // Repo-wide invariant: scan every .ts under src/ for executable

7162 // busy-wait patterns. Strip block comments so the pin only checks

7163 // executable code (comments may reference the removed pattern).

CHANGELOG.mdView file

Lines 882-922markdown

882### Fixed

883

884- **F1 — Session-lock TOCTOU race (multi-process).** Pre-v4.1.0

885 acquired `<session_dir>/.lock` by creating the file empty and then

886 writing PID metadata in a separate syscall. Across multiple host

887 processes sharing the same `data_dir`, a second process could

888 observe the empty lock between the two syscalls, fail to JSON-parse

889 it, remove it, create its own, and enter the critical section in

890 parallel with the first holder — corrupting `meta.json`.

Source & flagged code

4 flagged · loading source

dist/scripts/smoke.jsView file

7141patternName = private_key_rsa severity = critical line = 7141 matchedText = const tr...ED`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scripts/smoke.jsView on unpkg · L7141

7141patternName = private_key_rsa severity = critical line = 7141 matchedText = const tr...ED`;

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7141

7143patternName = private_key_rsa severity = critical line = 7143 matchedText = assert.o....");

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7143

CHANGELOG.mdView file

902patternName = private_key_rsa severity = critical line = 902 matchedText = `-----BE...hing

Critical

Secret Pattern

RSA private key in CHANGELOG.md

CHANGELOG.mdView on unpkg · L902

Findings

4 Critical2 Medium4 Low

CriticalCritical Secretdist/scripts/smoke.js

CriticalSecret PatternCHANGELOG.md

CriticalSecret Patterndist/scripts/smoke.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

86%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

AuthorLCV Ideas & Software

Maintainerslcv-leo

Version4.5.11

PublishedJul 11, 2026

LicenseApache-2.0

Dependencies8

Integrityverified

Package size722 KB

Files154

Keywordsmcpmodel-context-protocolcross-reviewmulti-agentopenaianthropicgeminideepseek

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/src/mcp/server.jstypes → ./dist/src/mcp/server.d.tsbin → cross-review, cross-review-dashboard

Runtimenode >=22

Artifact3.12 MB · 154 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: api-streaming-smoke, biome, biome:write, build +8

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

4 flagged

dist/scripts/smoke.jsView file

Lines 7121-7163javascript

7121 console.log("[smoke] agent_instruction_rename_history_test: PASS");

7122}

7123{

7124 const pkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), "package.json"), "utf8"));

7125 const script = String(pkg.scripts?.["release:verify-registry"] ?? "");

7126 assert.ok(script.includes("verify-registry-dist.mjs"), "v4.0.5 / AUDIT-6: package.json must expose release:verify-registry.");

7127 const verifyScript = fs.readFileSync(path.join(process.cwd(), "scripts", "verify-registry-dist.mjs"), "utf8");

7128 assert.ok(!verifyScript.includes("node:child_process"), "v4.0.6 / F1: verify-registry-dist.mjs must not spawn npm/npm.cmd; Windows Node hardening rejects npm.cmd spawn.");

7129 assert.ok(verifyScript.includes("https://registry.npmjs.org") && verifyScript.includes("fetch("), "v4.0.6 / F1: verify-registry-dist.mjs must query npm registry metadata directly.");

7131 assert.ok(!verifyScript.includes("readFileSync") &&

7132 !verifyScript.includes("readFile(") &&

7133 verifyScript.includes("npm_package_name") &&

7135 // v4.1.0 / F4: redactPrivateKeyBlocks must handle UNTERMINATED -----BEGIN

7136 // PRIVATE KEY----- blocks by redacting from BEGIN to end-of-string. Pre-

7137 // v4.1.0 leaked partial keys to events.ndjson when logs were truncated

7138 // mid-key. Empirical regression test:

7139 {

7140 const { redact } = await import("../src/security/redact.js");

7141 const truncatedKey = `error: -----BEGIN PRIVATE KEY-----\nMIIBVQIBADANBgkqhkiG9w0BAQEF...[TRUNCATED`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scripts/smoke.jsView on unpkg · L7141

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7141

7142 const redacted = redact(truncatedKey);

7143 assert.ok(redacted.includes("[REDACTED]"), "v4.1.0 / F4: redact() must emit [REDACTED] for unterminated -----BEGIN PRIVATE KEY----- blocks.");

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7143

7144 assert.ok(!redacted.includes("MIIBVQIBADANBgkqhkiG9w0BAQEF"), "v4.1.0 / F4: redact() must NOT leak the partial key body when the BEGIN marker has no matching END.");

7145 assert.equal(redact("just a normal log line"), "just a normal log line", "v4.1.0 / F4: redact() must be passthrough when no PRIVATE KEY markers are present.");

7146 console.log("[smoke] redact_unterminated_private_key_test: PASS");

7147 }

7148 // v4.1.0 / F5: writeJson + cache-manifest writeJsonAtomic must be

7149 // async AND no source file under src/ may contain the

7150 // `while (Date.now() - start < wait)` CPU-burning busy-wait pattern.

7151 // Pre-v4.1.0 this pattern blocked the event loop for up to 310 ms

7152 // under Windows AV stress. Codex R1 NEEDS_EVIDENCE catch on session

7153 // 059b0093 asked for repo-wide grep (the original pin only covered

7154 // session-store.ts and missed cache-manifest.ts:47).

7155 {

7156 const storeSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "session-store.ts"), "utf8");

7157 assert.ok(/async\s+function\s+writeJson\b/.test(storeSrc), "v4.1.0 / F5: writeJson must be declared `async function writeJson` in src/core/session-store.ts.");

7159 const cacheManifestSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "cache-manifest.ts"), "utf8");

7160 assert.ok(/async\s+function\s+writeJsonAtomic\b/.test(cacheManifestSrc), "v4.1.0 / F5: writeJsonAtomic in cache-manifest.ts must be `async function writeJsonAtomic`.");

7161 // Repo-wide invariant: scan every .ts under src/ for executable

7162 // busy-wait patterns. Strip block comments so the pin only checks

7163 // executable code (comments may reference the removed pattern).

CHANGELOG.mdView file

Lines 882-922markdown

882### Fixed

883

884- **F1 — Session-lock TOCTOU race (multi-process).** Pre-v4.1.0

885 acquired `<session_dir>/.lock` by creating the file empty and then

886 writing PID metadata in a separate syscall. Across multiple host

887 processes sharing the same `data_dir`, a second process could

888 observe the empty lock between the two syscalls, fail to JSON-parse

889 it, remove it, create its own, and enter the critical section in

890 parallel with the first holder — corrupting `meta.json`.