registry / @lcv-ideas-software/cross-review / 4.5.7

@lcv-ideas-software/cross-review@4.5.7

API-first MCP server for multi-model cross-review with unanimous convergence gates.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network use is the package’s stated multi-model review function and local persistence is confined to its configured data directory.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User explicitly runs `cross-review` or invokes its MCP review tools.

Impact

No install-time execution, credential harvesting, foreign agent-config mutation, remote payload loading, or destructive broad filesystem behavior found.

Mechanism

MCP orchestration of configured AI-provider API clients with local session storage.

Rationale

The flagged secret pattern is a deliberately synthetic test value used to verify redaction. Source inspection found no malicious execution chain or unconsented control-surface modification.

Evidence

package.jsondist/src/mcp/server.jsdist/src/dashboard/server.jsdist/src/core/caller-tokens.jsdist/src/core/session-store.jsdist/src/peers/perplexity.jsdist/scripts/smoke.jsdist/src/peers/openai.jsdist/src/peers/anthropic.jsdist/src/peers/gemini.js

Network endpoints1

api.perplexity.ai

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

`package.json` has no preinstall/install/postinstall/prepare lifecycle hook.
`dist/src/mcp/server.js` only starts when invoked as its executable entrypoint.
`dist/src/core/caller-tokens.js` creates package-local caller tokens with mode 0600.
`dist/src/dashboard/server.js` binds its dashboard to 127.0.0.1.
`dist/scripts/smoke.js` contains a synthetic `sk-test-...` redaction test, not a credential.
Provider adapters require configured API keys and use declared model-provider clients.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 1.90 MB of source, external domains: 127.0.0.1, ai.google.dev, api-docs.deepseek.com, api.deepseek.com, api.perplexity.ai, api.x.ai, cross-review.lcv.dev, developers.openai.com, docs.anthropic.com, docs.perplexity.ai, docs.x.ai, github.com, platform.claude.com, platform.openai.com, registry.npmjs.org

Source & flagged code

5 flagged

dist/scripts/smoke.jsView file

Lines 7149-7191javascript

7149 console.log("[smoke] agent_instruction_rename_history_test: PASS");

7150}

7151{

7152 const pkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), "package.json"), "utf8"));

7153 const script = String(pkg.scripts?.["release:verify-registry"] ?? "");

7154 assert.ok(script.includes("verify-registry-dist.mjs"), "v4.0.5 / AUDIT-6: package.json must expose release:verify-registry.");

7155 const verifyScript = fs.readFileSync(path.join(process.cwd(), "scripts", "verify-registry-dist.mjs"), "utf8");

7156 assert.ok(!verifyScript.includes("node:child_process"), "v4.0.6 / F1: verify-registry-dist.mjs must not spawn npm/npm.cmd; Windows Node hardening rejects npm.cmd spawn.");

7157 assert.ok(verifyScript.includes("https://registry.npmjs.org") && verifyScript.includes("fetch("), "v4.0.6 / F1: verify-registry-dist.mjs must query npm registry metadata directly.");

7158 assert.ok(verifyScript.includes("AbortSignal.timeout(") && verifyScript.includes("FETCH_TIMEOUT_MS"), "v4.0.7 / F2: verify-registry-dist.mjs must bound the npm registry fetch with an explicit AbortSignal.timeout so a slow registry surfaces as a deterministic abort instead of hanging the workflow.");

7159 assert.ok(!verifyScript.includes("readFileSync") &&

7160 !verifyScript.includes("readFile(") &&

7161 verifyScript.includes("npm_package_name") &&

7162 verifyScript.includes("npm_package_version"), "v4.0.8 / F3: verify-registry-dist.mjs must not read package.json from disk; PACKAGE_NAME/PACKAGE_VERSION come from env (or npm-script-injected npm_package_name/version). Removing the file-data → fetch flow kills the recurring js/file-access-to-http CodeQL false positive at the source.");

7163 // v4.1.0 / F4: redactPrivateKeyBlocks must handle UNTERMINATED -----BEGIN

7164 // PRIVATE KEY----- blocks by redacting from BEGIN to end-of-string. Pre-

7165 // v4.1.0 leaked partial keys to events.ndjson when logs were truncated

7166 // mid-key. Empirical regression test:

7167 {

7168 const { redact } = await import("../src/security/redact.js");

7169 const truncatedKey = `error: -----BEGIN PRIVATE KEY-----\nMIIBVQIBADANBgkqhkiG9w0BAQEF...[TRUNCATED`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scripts/smoke.jsView on unpkg · L7169

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7169

7170 const redacted = redact(truncatedKey);

7171 assert.ok(redacted.includes("[REDACTED]"), "v4.1.0 / F4: redact() must emit [REDACTED] for unterminated -----BEGIN PRIVATE KEY----- blocks.");

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7171

7172 assert.ok(!redacted.includes("MIIBVQIBADANBgkqhkiG9w0BAQEF"), "v4.1.0 / F4: redact() must NOT leak the partial key body when the BEGIN marker has no matching END.");

7173 assert.equal(redact("just a normal log line"), "just a normal log line", "v4.1.0 / F4: redact() must be passthrough when no PRIVATE KEY markers are present.");

7174 console.log("[smoke] redact_unterminated_private_key_test: PASS");

7175 }

7176 // v4.1.0 / F5: writeJson + cache-manifest writeJsonAtomic must be

7177 // async AND no source file under src/ may contain the

7178 // `while (Date.now() - start < wait)` CPU-burning busy-wait pattern.

7179 // Pre-v4.1.0 this pattern blocked the event loop for up to 310 ms

7180 // under Windows AV stress. Codex R1 NEEDS_EVIDENCE catch on session

7181 // 059b0093 asked for repo-wide grep (the original pin only covered

7182 // session-store.ts and missed cache-manifest.ts:47).

7183 {

7184 const storeSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "session-store.ts"), "utf8");

7185 assert.ok(/async\s+function\s+writeJson\b/.test(storeSrc), "v4.1.0 / F5: writeJson must be declared `async function writeJson` in src/core/session-store.ts.");

7186 assert.ok(/new\s+Promise[\s\S]{0,80}?setTimeout/.test(storeSrc), "v4.1.0 / F5: writeJson must use a Promise-based async delay (`new Promise(r => setTimeout(r, wait))`) for retry backoff so the event loop remains responsive.");

7187 const cacheManifestSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "cache-manifest.ts"), "utf8");

7188 assert.ok(/async\s+function\s+writeJsonAtomic\b/.test(cacheManifestSrc), "v4.1.0 / F5: writeJsonAtomic in cache-manifest.ts must be `async function writeJsonAtomic`.");

7189 // Repo-wide invariant: scan every .ts under src/ for executable

7190 // busy-wait patterns. Strip block comments so the pin only checks

7191 // executable code (comments may reference the removed pattern).

•matchType = previous_version_dangerous_delta matchedPackage = @lcv-ideas-software/cross-review@4.5.5 matchedIdentity = npm:[redacted]:4.5.5 similarity = 0.635 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/scripts/smoke.jsView on unpkg

CHANGELOG.mdView file

Lines 1159-1199markdown

1159### Fixed

1160

1161- **F1 — Session-lock TOCTOU race (multi-process).** Pre-v4.1.0

1162 acquired `<session_dir>/.lock` by creating the file empty and then

1163 writing PID metadata in a separate syscall. Across multiple host

1164 processes sharing the same `data_dir`, a second process could

1165 observe the empty lock between the two syscalls, fail to JSON-parse

1166 it, remove it, create its own, and enter the critical section in

1167 parallel with the first holder — corrupting `meta.json`

Source & flagged code

5 flagged · loading source

dist/scripts/smoke.jsView file

7169patternName = private_key_rsa severity = critical line = 7169 matchedText = const tr...ED`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scripts/smoke.jsView on unpkg · L7169

7169patternName = private_key_rsa severity = critical line = 7169 matchedText = const tr...ED`;

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7169

7171patternName = private_key_rsa severity = critical line = 7171 matchedText = assert.o....");

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7171

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/scripts/smoke.jsView on unpkg

CHANGELOG.mdView file

1179patternName = private_key_rsa severity = critical line = 1179 matchedText = `-----BE...hing

Critical

Secret Pattern

RSA private key in CHANGELOG.md

CHANGELOG.mdView on unpkg · L1179

Findings

4 Critical1 High2 Medium4 Low

CriticalCritical Secretdist/scripts/smoke.js

CriticalSecret PatternCHANGELOG.md

CriticalSecret Patterndist/scripts/smoke.js

HighPrevious Version Dangerous Deltadist/scripts/smoke.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

94%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

AuthorLCV Ideas & Software

Maintainerslcv-leo

Version4.5.11

PublishedJul 12, 2026

LicenseApache-2.0

Dependencies8

Integrityverified

Package size893 KB

Files185

Keywordsmcpmodel-context-protocolcross-reviewmulti-agentopenaianthropicgeminideepseek

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/src/mcp/server.jstypes → ./dist/src/mcp/server.d.tsbin → cross-review, cross-review-dashboard

Runtimenode >=22

Artifact4.02 MB · 185 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: api-streaming-smoke, biome, biome:write, build +8

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

5 flagged

dist/scripts/smoke.jsView file

Lines 7149-7191javascript

7149 console.log("[smoke] agent_instruction_rename_history_test: PASS");

7150}

7151{

7152 const pkg = JSON.parse(fs.readFileSync(path.join(process.cwd(), "package.json"), "utf8"));

7153 const script = String(pkg.scripts?.["release:verify-registry"] ?? "");

7154 assert.ok(script.includes("verify-registry-dist.mjs"), "v4.0.5 / AUDIT-6: package.json must expose release:verify-registry.");

7155 const verifyScript = fs.readFileSync(path.join(process.cwd(), "scripts", "verify-registry-dist.mjs"), "utf8");

7156 assert.ok(!verifyScript.includes("node:child_process"), "v4.0.6 / F1: verify-registry-dist.mjs must not spawn npm/npm.cmd; Windows Node hardening rejects npm.cmd spawn.");

7157 assert.ok(verifyScript.includes("https://registry.npmjs.org") && verifyScript.includes("fetch("), "v4.0.6 / F1: verify-registry-dist.mjs must query npm registry metadata directly.");

7159 assert.ok(!verifyScript.includes("readFileSync") &&

7160 !verifyScript.includes("readFile(") &&

7161 verifyScript.includes("npm_package_name") &&

7163 // v4.1.0 / F4: redactPrivateKeyBlocks must handle UNTERMINATED -----BEGIN

7164 // PRIVATE KEY----- blocks by redacting from BEGIN to end-of-string. Pre-

7165 // v4.1.0 leaked partial keys to events.ndjson when logs were truncated

7166 // mid-key. Empirical regression test:

7167 {

7168 const { redact } = await import("../src/security/redact.js");

7169 const truncatedKey = `error: -----BEGIN PRIVATE KEY-----\nMIIBVQIBADANBgkqhkiG9w0BAQEF...[TRUNCATED`;

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scripts/smoke.jsView on unpkg · L7169

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7169

7170 const redacted = redact(truncatedKey);

7171 assert.ok(redacted.includes("[REDACTED]"), "v4.1.0 / F4: redact() must emit [REDACTED] for unterminated -----BEGIN PRIVATE KEY----- blocks.");

Critical

Secret Pattern

RSA private key in dist/scripts/smoke.js

dist/scripts/smoke.jsView on unpkg · L7171

7172 assert.ok(!redacted.includes("MIIBVQIBADANBgkqhkiG9w0BAQEF"), "v4.1.0 / F4: redact() must NOT leak the partial key body when the BEGIN marker has no matching END.");

7173 assert.equal(redact("just a normal log line"), "just a normal log line", "v4.1.0 / F4: redact() must be passthrough when no PRIVATE KEY markers are present.");

7174 console.log("[smoke] redact_unterminated_private_key_test: PASS");

7175 }

7176 // v4.1.0 / F5: writeJson + cache-manifest writeJsonAtomic must be

7177 // async AND no source file under src/ may contain the

7178 // `while (Date.now() - start < wait)` CPU-burning busy-wait pattern.

7179 // Pre-v4.1.0 this pattern blocked the event loop for up to 310 ms

7180 // under Windows AV stress. Codex R1 NEEDS_EVIDENCE catch on session

7181 // 059b0093 asked for repo-wide grep (the original pin only covered

7182 // session-store.ts and missed cache-manifest.ts:47).

7183 {

7184 const storeSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "session-store.ts"), "utf8");

7185 assert.ok(/async\s+function\s+writeJson\b/.test(storeSrc), "v4.1.0 / F5: writeJson must be declared `async function writeJson` in src/core/session-store.ts.");

7187 const cacheManifestSrc = fs.readFileSync(path.join(process.cwd(), "src", "core", "cache-manifest.ts"), "utf8");

7188 assert.ok(/async\s+function\s+writeJsonAtomic\b/.test(cacheManifestSrc), "v4.1.0 / F5: writeJsonAtomic in cache-manifest.ts must be `async function writeJsonAtomic`.");

7189 // Repo-wide invariant: scan every .ts under src/ for executable

7190 // busy-wait patterns. Strip block comments so the pin only checks

7191 // executable code (comments may reference the removed pattern).

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/scripts/smoke.jsView on unpkg

CHANGELOG.mdView file

Lines 1159-1199markdown

1159### Fixed

1160

1161- **F1 — Session-lock TOCTOU race (multi-process).** Pre-v4.1.0

1162 acquired `<session_dir>/.lock` by creating the file empty and then

1163 writing PID metadata in a separate syscall. Across multiple host

1164 processes sharing the same `data_dir`, a second process could

1165 observe the empty lock between the two syscalls, fail to JSON-parse

1166 it, remove it, create its own, and enter the critical section in

1167 parallel with the first holder — corrupting `meta.json`