/cross-pollinate

name: cross-pollinate
description: "Take a confirmed vulnerability pattern and find the same bug in similar packages. Usage: /cross-pollinate (run after confirming a finding)."

/cross-pollinate

Take a confirmed vulnerability pattern from the current finding and systematically search for the same pattern in similar packages.

Why Cross-Pollinate?

When you find a vulnerability in one package, similar packages often have the same bug. A ReDoS in one CSV parser likely exists in other CSV parsers. A path traversal in one archive library likely exists in other archive libraries.

This is the highest-ROI research strategy: one bug class, many CVEs.

Process

Step 1: Extract the Pattern

From the current confirmed finding, identify:

PATTERN EXTRACTION

Vulnerability class: <e.g., ReDoS, path traversal, prototype pollution>
Root cause pattern: <e.g., "regex with nested quantifiers on user input">
Code signature: <e.g., "new RegExp(userInput)" or "path.join(base, userInput)">
Grep pattern: <regex that would find this pattern in other codebases>
Package category: <e.g., CSV parsers, archive extractors, template engines>

Step 2: Find Similar Packages

Search for packages in the same category:

# npm search for similar packages
npm search "<category keyword>" --long | head -30

# GitHub search
gh search repos "<category>" --language javascript --stars 500..15000 --sort stars --limit 20

# Check which alternatives exist
# (often listed in the package's README as "alternatives" or "see also")

Step 3: Filter Candidates

For each similar package: 1. Check REGISTRY.md -- skip if already investigated 2. Check download count -- skip if <100K/week 3. Check if it handles the same input type 4. Quick grep for the vulnerable pattern:

# Clone minimally and search
git clone --depth 1 <repo-url> /tmp/cross-pollinate-check
grep -rn "<pattern>" /tmp/cross-pollinate-check/src/ /tmp/cross-pollinate-check/lib/
rm -rf /tmp/cross-pollinate-check

Step 4: Rank by Likelihood

Score each candidate:

| Factor | Score | |--------|-------| | Same language as original finding | +2 | | Same input format (CSV, XML, etc.) | +3 | | Grep pattern found in source | +5 | | No existing CVEs for this vuln class | +3 | | >500K weekly downloads | +2 | | Active maintenance | +1 |

Present the top 5 candidates ranked by score.

Step 5: Propose to Director

CROSS-POLLINATION CANDIDATES

Original finding: <vuln type> in <original package>
Pattern: <what we're looking for>

#1. <package> (score: <N>)
    Downloads: <count>/week | Stars: <count>
    Pattern match: <what grep found>

#2. <package> (score: <N>)
    ...

#3. <package> (score: <N>)
    ...

Recommend investigating #1 first. Approve?

Step 6: Hunt Each Candidate

For each approved candidate, run a focused `/hunt` targeting ONLY the identified vulnerability class. This is faster than a full review because you know exactly what to look for.

Step 7: Track Results

Update REGISTRY.md with all results, noting the cross-pollination origin:

| <new-package> | <date> | Hunter | <vuln-class> (cross-pollinated from <original>) |

Common Cross-Pollination Targets

| If you found this in... | Also check... | |---|---| | One CSV parser | csv-parse, papaparse, csv-parser, fast-csv, csvtojson | | One XML parser | fast-xml-parser, xml2js, xml-js, sax, htmlparser2 | | One archive lib | archiver, decompress, JSZip, fflate, adm-zip, tar-stream | | One template engine | ejs, pug, nunjucks, handlebars, mustache, eta, doT | | One deep merge/clone | deepmerge, lodash.merge, rfdc, klona, clone-deep | | One schema validator | ajv, joi, yup, zod (for plugin/extension vulns) | | One URL parser | url-parse, query-string, qs, fast-querystring | | One image lib | sharp, jimp, pngjs, jpeg-js, utif2, bmp-js | | One markdown parser | marked, markdown-it, showdown, remark, snarkdown | | One YAML parser | js-yaml, yaml, go-yaml |