npm scope
@chem-x
LPM Firewall blocks 2 packages in the @chem-x npm scope. 2 have LPM's own review and are listed first.
Oct 18, 2026
@chem-x/starter-kit@26.10.8-344
AI-agent control-surface riskThe postinstall hook performs unconsented changes to project and global AI-agent control configuration and enables the package's MCP capabilities. This is concrete installation-time contr...
Oct 18, 2026
@chem-x/create-chemx@26.10.8-344
AI-agent control-surface riskThe package has an automatic postinstall hook that mutates project and global AI-agent configuration to register its MCP server without affirmative consent. This is an unconsented install...
Each card opens the package page with its evidence and every recorded version.